Local Accounts

Attackers sign in with accounts that exist only on one host, such as a built-in administrator or a local service account, instead of a domain account. It is a sub-technique of Valid Accounts, serving several tactics at once. Local accounts are often less watched than domain accounts, and when the same local password is set on many hosts, one stolen password opens all of them.

The attacker recovers a local account's password or its stored hash from one host, then uses it to sign in to that host again later or to other hosts where the same password was set. On Linux they sign in over a remote shell with a local user's password or key. Because the account belongs to the host, domain-wide controls such as password resets may never touch it.

Data source: Windows Security events (logons); Linux authentication logs

{
  "host": {
    "name": "ws-611.corp.example"
  },
  "user": {
    "name": "lclmaint9",
    "domain": "WS-611"
  },
  "event": {
    "code": "4624",
    "outcome": "success"
  },
  "source": {
    "ip": "192.0.2.143"
  },
  "winlog": {
    "logon": {
      "type": "Network"
    }
  },
  "@timestamp": "2026-06-09T03:02:11.638Z"
}

Prebuilt Elastic rule: Spike in Successful Logon Events from a Source IP

On Windows, a local account's sign-in shows the host's own name where a domain account shows the domain. Start with network sign-ins by local accounts, which are rare in most networks: successful 4624 events where user.domain equals the host's short name. Then look for the same local account name signing in to many hosts from one address. Look for local accounts used over the network, the same local account appearing on several hosts within minutes, and sign-ins from addresses outside the IT team's hosts.

Some management tools and older applications use local accounts over the network by design, and administrators use them when a host can't reach the domain. Check whether the source is a known management server, whether the account is documented for that use, and whether the timing matches maintenance. One local account spreading across many hosts is rarely routine. The prebuilt rule named on this page is a machine-learning job, so it alerts only while that job is running.

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

• Linux audit framework (auditd)
  • USER_LOGIN User login
• syslog / journald (auth, secure, messages, cron) (the log as a whole)
• macOS unified log (the log as a whole)
• Windows Security event log
  • 4624 An account was successfully logged on.
  • 4648 A logon was attempted using explicit credentials.
  • 4672 Special privileges assigned to new logon.

• MITRE ATT&CK, Valid Accounts: Local Accounts
• Microsoft Learn, 4624(S): An account was successfully logged on

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.