Skip to content
Sign In
Learn

T1078.002

Domain Accounts

Also appears in: Persistence · Privilege Escalation · Stealth

What it is

Attackers sign in with real domain accounts whose passwords they have stolen, guessed or bought, so their activity looks like an ordinary employee's. It is a sub-technique of Valid Accounts, which serves several tactics at once: getting in, staying in, moving around and gaining privilege. Because nothing breaks and every sign-in succeeds, it is one of the hardest techniques to spot.

How adversaries use it

The attacker uses a domain account's credentials to sign in to workstations, servers and remote services across the network. Accounts with broad access, such as administrators and service accounts, are the most valuable. Once one account works, the attacker often collects more credentials from the hosts it reaches and moves on with those.

Detect it in Elastic

Data source: Windows Security events (logons) on workstations, servers and domain controllers

Key fields

event.code: 4624 when a logon succeeds, 4625 when it fails user.name and user.domain: the account that signed in source.ip: the address the sign-in came from winlog.logon.type: how the account signed in host.name: the host that was signed in to @timestamp

Example event

{
  "host": {
    "name": "srv-552.corp.example"
  },
  "user": {
    "name": "a.halloran",
    "domain": "CORP"
  },
  "event": {
    "code": "4624",
    "outcome": "success"
  },
  "source": {
    "ip": "192.0.2.143"
  },
  "@timestamp": "2026-06-09T02:17:44.906Z"
}

Prebuilt Elastic rule: Rare User Logon

Hunt guidance

A successful sign-in is only suspicious in context, so build a baseline per account first. Start with successful logons: event.code: 4624 and user.domain: "CORP", grouped by user.name, host.name and source.ip. Then compare each account's recent hosts, addresses and hours with its usual ones. Look for an account signing in to hosts it has never used, many hosts within minutes, sign-ins at hours the person doesn't work, and service accounts signing in interactively.

Ruling out legitimate activity

People travel, change desks, work late and get new duties, and administrators sign in to many hosts as part of their job. Check whether the account's owner was working, whether a change or ticket explains new access, and what the account did after signing in. New access followed by discovery or copying is the pattern that matters. The prebuilt rule named on this page is a machine-learning job, so it alerts only while that job is running.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.