Skip to content

Local Accounts

Subtechnique · ATTACK:enterprise:T1078.003

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1078.003",
  "title": "Local Accounts",
  "type": "Subtechnique",
  "source_url": "https://attack.mitre.org/techniques/T1078/003",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--fdc47f44-dd32-4b99-af5f-209f556f63c2",
  "external_id": "T1078.003",
  "domain": "enterprise",
  "created": "2020-03-13T20:26:46.695Z",
  "modified": "2026-05-12T15:12:00.726Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth",
    "persistence",
    "privilege-escalation",
    "initial-access"
  ],
  "source_references": [

  ]
}

Explicit source assertions (29)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:G0094 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--184bf796-4f6d-4d0e-921e-08eb3023b97e

Netscout Stolen Pencil Dec 2018

ATTACK:enterprise:S0367 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30930d8a-3c0d-41b2-a226-cccc56599bfd

Malwarebytes Emotet Dec 2017

ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3a2883ee-60fb-4123-9d82-9ade53f4b43b

CobaltStrike Daddy May 2017 · cobaltstrike manual

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--4f8dca9b-86d0-4d97-98ed-c98240cc3933

Kubernetes Service Accounts · Microsoft Remote Use of Local · TechNet Credential Theft · TechNet Least Privilege

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--528d581d-aa34-4162-a773-6b329c3af4cb

ATTACK:enterprise:G0056 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--56e4bdb5-a57a-463a-a396-7bed2eb6893e

Bitdefender StrongPity June 2020

ATTACK:enterprise:G0051 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e56eeb2-9ca5-496d-9348-8e337af5f0d8

FireEye FIN10 June 2017

ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5e856280-00bc-4b8c-aec4-8ca3fd29ef62

Trend Micro Ransomware Spotlight Play July 2023

ATTACK:enterprise:C0064 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64b10169-7f16-478c-92c1-4aef63ac1a66

AI-Mexico-Govt-Compromise

ATTACK:enterprise:G0050 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--70bc1a16-3c57-4198-b2f9-c7f27bec271c

FireEye APT32 May 2017

ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7d770dbe-1baa-4411-bd37-b703c6f86585

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8543032a-2f76-4837-90d3-ffd54f6e8708

ATTACK:enterprise:G1041 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8a5adaba-f234-4bae-b71e-40eda5f5bd26

Hunt Sea Turtle 2024

ATTACK:enterprise:G0081 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--95122d43-9de8-4eef-bc46-6fdc5cc276a9

TrendMicro Tropic Trooper May 2020

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--996765a6-6c8a-429d-baa5-32d423fb4207

FireEye Exchange Zero Days March 2021

ATTACK:enterprise:C0062 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a0d76a11-92bf-4292-b411-f3a8b019beb4

Anthropic AI Orchestrated Campaign NOV 2025

ATTACK:enterprise:T1078.003 → subtechnique-of → ATTACK:enterprise:T1078

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1a39cf1-dd69-4110-beac-77bf7acd0c62

ATTACK:enterprise:G0046 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b1323523-7596-4cc2-bd31-34363e4e9b60

Microsoft Ransomware as a Service

ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bb886759-3494-4834-9765-2f0c12e0b391

CrowdStrike StellarParticle January 2022

ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c9f76562-98c9-4f58-a9ea-790cf792490a

CISA Leviathan 2024

ATTACK:enterprise:G1047 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d725ab2f-2dde-496b-b2a8-8ed250e14cce

Sygnia VelvetAnt 2024B

ATTACK:enterprise:G0016 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--df9a9828-dff0-41a1-a93d-d410fb2ee3b9

NCSC et al APT29 2024

ATTACK:enterprise:S0368 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e21a2fb4-1ba6-41dc-9278-72f6824382d8

Talos Nyetya June 2017 · US-CERT NotPetya 2017

ATTACK:enterprise:G0082 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e2ba0562-706c-482e-892e-b46ef117fcbf

Microsoft Sapphire Sleet APR 2026

ATTACK:enterprise:S1202 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e98cd360-3832-4b30-aa06-ad61d1b665ab

Joint Cybersecurity Advisory LockBit 3.0 MAR 2023

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ec2a35a4-081b-421d-a280-f808f6b93b48

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:S0221 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f0b6fe64-e138-42c9-9cc7-896467dc26f8

Umbreon Trend Micro

ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f2064ee3-66e3-4856-a376-e34b2ec9f90f

FoxIT Wocao December 2019

ATTACK:enterprise:G0010 → uses → ATTACK:enterprise:T1078.003

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f4268a0d-0539-46de-bad8-ea72af455585

ESET Crutch December 2020

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.