aol.pm

Valid Accounts

Technique · ATTACK:ics:T0859

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance
{
  "id": "ATTACK:ics:T0859",
  "title": "Valid Accounts",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T0859",
  "snapshot": "ics-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--cd2c76a4-5e23-4ca5-9c40-d5e0604f7101",
  "external_id": "T0859",
  "domain": "ics",
  "created": "2020-05-21T17:43:26.506Z",
  "modified": "2026-10-13T17:48:33.956Z",
  "version": "1.1",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "lateral-movement"
  ],
  "source_references": [
    {
      "source_name": "Booz Allen Hamilton",
      "url": "https://www.boozallen.com/content/dam/boozallen/documents/2016/09/ukraine-report-when-the-lights-went-out.pdf"
    }
  ]
}

Explicit source assertions (18)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:ics:G1000 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--0eb112f6-c1cb-4843-93f5-f668aa0e9bd8

Dragos

ATTACK:ics:M0801 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--104b4f25-d0a9-41f6-94b3-fa85ee8b1523

ATTACK:ics:M0926 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--111f437a-c67d-40e4-9515-7e9b22e65eff

Microsoft May 2017 · Microsoft August 2018 · Microsoft February 2019

ATTACK:ics:M0918 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--1fc147bd-d6ab-4beb-908b-0fbe8e125b76

ATTACK:ics:C0028 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2f0d1a71-7cb6-4979-b072-a859d117d47f

Booz Allen Hamilton · Ukraine15 - EISAC - 201603

ATTACK:ics:M0937 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5dfa5bad-8b0b-4884-bf01-04ea89e3ccf7

ATTACK:ics:S1045 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6681bc38-0b55-4714-b690-c609956b40bf

CISA-AA22-103A · Wylie-22

ATTACK:ics:C0063 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--954fc7ef-7e8a-446c-82d1-9798d8c00fbe

CERT Polska

ATTACK:ics:M0932 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9b412b1f-2dd0-4e7f-8364-f625181ba1db

ATTACK:ics:M0927 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a1383f2a-2ee2-47df-a661-8904a7535e0c

CISA June 2013

ATTACK:ics:C0025 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a6479493-6154-408f-90df-9d2f3ae352d1

Dragos Crashoverride 2018

ATTACK:ics:M0913 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b69f31c3-6c12-4b81-8e74-9c58ea635fa4

CISA June 2013

ATTACK:ics:M0947 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--baf7daf3-2116-4051-91b5-f82e146167d0

ATTACK:ics:C0030 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--bf0e7347-1636-4b5e-9e2a-8b93177e5f85

FireEye TRITON 2018

ATTACK:ics:M0936 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ea817c7a-9424-4204-90a5-6f8fb86037be

Keith Stouffer May 2015

ATTACK:ics:S0089 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ee2fdebd-1587-4e53-a7d7-c15fcc88879d

Booz Allen Hamilton

ATTACK:ics:M0915 → mitigates → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--eeeaa0d4-0ca0-468e-ae13-43ab7aba61b4

Keith Stouffer May 2015 · Schweitzer Engineering Laboratories August 2015

ATTACK:ics:G0049 → uses → ATTACK:ics:T0859

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--f65a8ce8-90fa-4d92-a0dc-3ee544c541fe

Dragos

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.