Valid Accounts

What is Valid Accounts?

“Valid Accounts is documented as technique T1078 in MITRE ATT&CK® v19.1 under the Initial Access tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Valid Accounts activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Implement User and Entity Behavior Analytics to establish behavioral baselines for each account and alert on deviations such as logins at unusual hours, access to resources not previously accessed, or abnormal command execution patterns.

2. 2

   Monitor for authentication events using accounts that have been inactive for extended periods, particularly service accounts, contractor accounts, and accounts belonging to former employees that should have been disabled.

3. 3

   Track lateral movement patterns by correlating authentication events across multiple systems to identify accounts being used to authenticate to an unusually large number of systems within a short time window.

4. 4

   Alert on the use of default or commonly known credentials against internet-facing services, network devices, and internal applications that may not enforce strong password policies.

5. 5

   Correlate failed and successful authentication attempts with threat intelligence feeds containing known compromised credential lists to identify accounts whose passwords may have appeared in public data breaches.

Example Alerts

These realistic alert examples show what Valid Accounts looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Valid Accounts?

Detection centers on SIEM, XDR telemetry for the initial access phase of the attack. Implement User and Entity Behavior Analytics to establish behavioral baselines for each account and alert on deviations such as logins at unusual hours, access to resources not previously accessed, or abnormal command execution patterns. Monitor for authentication events using accounts that have been inactive for extended periods, particularly service accounts, contractor accounts, and accounts belonging to former employees that should have been disabled.

What does a Valid Accounts alert look like?

A representative SIEM detection is "Dormant Service Account Activity Detected" (high severity): Service account svc_backup_old authenticated to 12 different systems over 20 minutes, including domain controllers and file servers containing sensitive financial data. The account has shown no activity for 847 days and was scheduled for decommission. Current activity does not match any scheduled backup job window.

Which tools detect Valid Accounts, and how can I practice?

Valid Accounts (T1078) is best surfaced with SIEM, XDR telemetry, which exposes the initial access signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.