Domain Accounts
Subtechnique · ATTACK:enterprise:T1078.002
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1078.002",
"title": "Domain Accounts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1078/002",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--c3d4bdd9-2cfe-4a80-9d0c-07a29ecdce8f",
"external_id": "T1078.002",
"domain": "enterprise",
"created": "2020-03-13T20:21:54.758Z",
"modified": "2026-05-12T15:12:00.714Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"persistence",
"privilege-escalation",
"initial-access"
],
"source_references": [
{
"source_name": "TechNet Credential Theft",
"url": "https://technet.microsoft.com/en-us/library/dn535501.aspx"
},
{
"source_name": "Microsoft AD Accounts",
"url": "https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/active-directory-accounts"
}
]
}Explicit source assertions (42)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:S1024 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--03a2f02b-ca0c-4366-8880-6cb6015fd722
Microsoft POLONIUM June 2022ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0561610c-dbcd-454f-aa33-8a68086c0b3a
ATTACK:enterprise:C0002 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--09c0322c-a714-4768-9d30-04160d2d7b2a
McAfee Night DragonATTACK:enterprise:C0023 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0a154ef3-859f-4f13-b5c9-9bd0e91864f0
ESET Dukes October 2019ATTACK:enterprise:C0048 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d507109-632e-49e3-92ed-f9186a4ebf27
Volexity UPSTYLE 2024ATTACK:enterprise:S0154 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0fee0f43-7352-4503-867b-ae17eb7c278b
CobaltStrike Daddy May 2017 · cobaltstrike manual · Cobalt Strike Manual 4.3 November 2020ATTACK:enterprise:C0059 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--1e3b8b61-70f2-4824-9b9c-cc532aa17c7e
FBI Salesforce Data Theft SEP 2025 · Google Salesforce JUN 2025ATTACK:enterprise:G0019 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--21298951-67d3-4904-97be-f7a57d120383
Bitdefender Naikon April 2021ATTACK:enterprise:C0049 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--250eabe6-6a1f-4c07-a5d4-5d1aceb3a961
CISA Leviathan 2024ATTACK:enterprise:C0012 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--269229ec-bb95-4ad1-b68e-267b2cce4f24
Cybereason OperationCuckooBees May 2022ATTACK:enterprise:G1030 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2bad61ee-c880-422a-a918-f017f970fd81
Unit42 Agrius 2023ATTACK:enterprise:G0102 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--2dd33387-a109-46cd-8204-cb79a62e4830
FireEye KEGTAP SINGLEMALT October 2020ATTACK:enterprise:G0034 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--32478440-a1d2-458d-a749-e2d200415106
Microsoft Prestige ransomware October 2022 · US District Court Indictment GRU Unit 74455 October 2020ATTACK:enterprise:C0024 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--37213eca-1510-4893-b27a-f17a8dd16a78
CrowdStrike StellarParticle January 2022ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--40254079-0c5a-4855-89ea-144a9d4585c2
Check Point VOID MANTICORE Handala Hack March 2026ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--45912a00-141c-45ec-afb6-2ac272764c14
ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4cdd118b-5ad8-4607-94b2-be828038b5ff
ATTACK:enterprise:M1017 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--4d0c0d1b-94a7-4518-b57e-e79212354bbf
ATTACK:enterprise:S0446 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--561f217e-8392-40b3-84a7-29fbd1399d88
ANSSI RYUK RANSOMWAREATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5b675a26-550f-44a0-a15d-908bdc8703ff
Mandiant_UNC1549TTPsTools_Nov2025ATTACK:enterprise:G0049 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5ca26415-3f7b-4885-9430-1034665872d7
Trend Micro Earth Simnavaz October 2024ATTACK:enterprise:S0140 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--5e6e745f-d756-4b6e-90e1-3adcf848570b
Unit 42 Shamoon3 2018 · FireEye Shamoon Nov 2016ATTACK:enterprise:G1021 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6e478b50-57b3-418b-b866-8441be0036b6
Microsoft Ransomware as a ServiceATTACK:enterprise:G1022 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--6fb67c72-b963-415f-a0fc-dbd34c3442f2
Kaspersky ToddyCat Check Logs October 2023ATTACK:enterprise:G0119 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--739217f2-c273-4005-8175-1261a81a1224
Crowdstrike Indrik November 2018ATTACK:enterprise:G0022 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--8ac07a3f-9468-47a3-8ecc-c432f80e03f4
Symantec BuckeyeATTACK:enterprise:G0114 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--90c8ecca-41d2-4a28-84fe-b76c1d969363
NCC Group Chimera January 2021ATTACK:enterprise:G1057 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9102a3f8-73c4-4a07-934c-13045415cc6a
SOCRadar_ShinyHunters_Mar2024ATTACK:enterprise:C0014 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94a6e104-9afd-4271-af39-6ab02eb53dfd
FoxIT Wocao December 2019ATTACK:enterprise:C0063 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--94c6a2cd-b987-46bc-b9e4-48e17bd1f165
CERT PolskaATTACK:enterprise:T1078.002 → subtechnique-of → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9af1f7b6-d914-4916-9fee-e8ca0e9c8109
ATTACK:enterprise:G1040 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--ad8a8754-3852-440f-926e-22ec8dcf419a
Trend Micro Ransomware Spotlight Play July 2023ATTACK:enterprise:G0092 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--b7a9afc1-3bbf-4eda-9709-5392156c1e41
IBM TA505 April 2020ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--bd2a538d-7e43-49bd-86fc-f4eae98e8d84
ATTACK:enterprise:G0028 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--c6358f18-fc64-46f5-8939-66e5258dd83d
Dell TG-1314ATTACK:enterprise:G1023 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cdf6b439-62d6-4052-91ee-a154f674c68f
Mandiant Pulse Secure Zero-Day April 2021ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d3db2181-a79e-49df-b169-f6b7c52fd7a5
DFIR Phosphorus November 2021ATTACK:enterprise:C0029 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d45c5aa0-8f47-4ccc-b78f-48391d41ecc6
Volexity Ivanti Zero-Day Exploitation January 2024ATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d45ff9eb-aca1-4bda-b5a8-fd4034ac8f1e
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:G1017 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d51a3ee4-4542-4334-9989-249aa107c261
CISA AA24-038A PRC Critical Infrastructure February 2024 · Secureworks BRONZE SILHOUETTE May 2023 · Microsoft Volt Typhoon May 2023ATTACK:enterprise:G1043 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d7770d18-bb2c-4a78-bf3f-a9abb1a58862
Cisco BlackByte 2024 · Microsoft BlackByte 2023ATTACK:enterprise:G0143 → uses → ATTACK:enterprise:T1078.002
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--df0f23e4-79c0-40e5-88ea-0ec4f07302d2
Crowdstrike HuntReport 2022