TA0001 · INITIAL ACCESS
Local Accounts
Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Detect it with
Perform regular audits of local system accounts to detect accounts that may have been created by an adversary for persistence. Look for suspicious account behavior, such as accounts logged in at odd times or outside of business hours.
Why it matters on shift
Local Accounts is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context