Adversaries may steal the credentials of a specific user or service account using credential access techniques or capture credentials earlier in their reconnaissance process through social engineering as a means of gaining initial access. APT33, for example, has used valid accounts for initial access and privilege escalation. The query below It identifies interactive logons made by dormant accounts that also have local admin privileges a strong indicator of suspicious activity.

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.