T1078 — Valid Accounts

# T1078 - Valid Accounts

## SOC Recommendation
Treat as potential account compromise. Validate sign-in activity, token usage, MFA changes, device posture, privilege changes, mailbox rules, OAuth grants, and lateral movement indicators before deciding whether this is expected user behaviour or an active intrusion.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Domain Account Monitoring | Detect | Review domain/directory sign-in activity for the account -- risky sign-ins, impossible travel, unfamiliar devices, MFA prompts. |
| Local Account Monitoring | Detect | Review local account logon activity on the affected host for use of the same credential outside the directory-managed path. |
| Account Locking | Evict | Lock or disable the account once compromise is confirmed, and revoke its active sessions and refresh tokens. |
| User Account Permissions | Isolate | Review and, if needed, restrict the account's role assignments and group memberships to limit what a compromised session can reach. |

## Investigation Steps
1. Review Entra ID SigninLogs for the user over the last 24 hours.
2. Check risky users and risky sign-ins.
3. Review MFA registration and authentication method changes.
4. Review AuditLogs for role assignments and group membership changes.
5. Check Exchange mailbox forwarding and inbox rules.
6. Review OAuth app consent grants.
7. Check Defender XDR for endpoint activity after the suspicious sign-in.

## Evidence to Collect
- User principal name
- Source IP
- Location
- Device ID
- User agent
- Application accessed
- Sign-in result
- MFA status
- Token activity
- Group or role changes
- Mailbox rule changes
- OAuth consent grants

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Revoke user sessions | Low | Yes | No |
| Reset password | Medium | No | Yes |
| Temporarily disable account | High | No | Yes |

## KQL
```kql
SigninLogs
| where UserPrincipalName =~ "<user>"
| where TimeGenerated > ago(24h)
| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResultType, ResultDescription
```
```kql
AuditLogs
| where TargetResources has "<user>"
| where TimeGenerated > ago(24h)
| project TimeGenerated, OperationName, InitiatedBy, TargetResources
```

## Escalation Criteria
- Privileged account involved.
- Break-glass account involved.
- Successful sign-in from unfamiliar country.
- MFA method was changed.
- OAuth grant was added.
- Mailbox forwarding rule was created.
- Access to sensitive data occurred after sign-in.
- Service principal or managed identity involved.

## False Positive Considerations
- User travel.
- VPN egress.
- Known corporate proxy.
- Approved admin maintenance.
- Red team activity.
- New device enrolment.
- Conditional Access policy changes.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1078.json
• /api/recommendations/T1078.json
• /api/d3fend/T1078.json
• /api/mappings/T1078.json
• /api/confluence/T1078.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1078.json

Response:

{
  "technique_id": "T1078",
  "name": "Valid Accounts",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Initial Access",
    "Persistence",
    "Privilege Escalation",
    "Stealth"
  ],
  "platforms": [
    "Windows",
    "Linux",
    "macOS",
    "Azure AD",
    "Office 365",
    "SaaS"
  ],
  "summary": "Adversaries may obtain and abuse credentials of existing accounts as a means of gaining initial access, persistence, privilege escalation, or defense evasion. Compromised credentials can bypass access controls and blend in with legitimate activity, making valid account abuse hard to detect with signature-based tooling alone.\n",
  "soc_recommendation": "Treat as potential account compromise. Validate sign-in activity, token usage, MFA changes, device posture, privilege changes, mailbox rules, OAuth grants, and lateral movement indicators before deciding whether this is expected user behaviour or an active intrusion.\n",
  "d3fend_mappings": [
    {
      "id": "D3-DAM",
      "name": "Domain Account Monitoring",
      "relationship": "detect",
      "practical_action": "Review domain/directory sign-in activity for the account -- risky sign-ins, impossible travel, unfamiliar devices, MFA prompts.\n",
      "tooling": [
        "Sentinel",
        "Entra ID",
        "Defender XDR"
      ]
    },
    {
      "id": "D3-LAM",
      "name": "Local Account Monitoring",
      "relationship": "detect",
      "practical_action": "Review local account logon activity on the affected host for use of the same credential outside the directory-managed path.\n",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-AL",
      "name": "Account Locking",
      "relationship": "evict",
      "practical_action": "Lock or disable the account once compromise is confirmed, and revoke its active sessions and refresh tokens.\n",
      "tooling": [
        "Microsoft Graph",
        "Entra ID"
      ]
    },
    {
      "id": "D3-UAP",
      "name": "User Account Permissions",
      "relationship": "isolate",
      "practical_action": "Review and, if needed, restrict the account's role assignments and group memberships to limit what a compromised session can reach.\n",
      "tooling": [
        "Entra ID",
        "AuditLogs"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Entra ID SigninLogs for the user over the last 24 hours.",
      "Check risky users and risky sign-ins.",
      "Review MFA registration and authentication method changes.",
      "Review AuditLogs for role assignments and group membership changes.",
      "Check Exchange mailbox forwarding and inbox rules.",
      "Review OAuth app consent grants.",
      "Check Defender XDR for endpoint activity after the suspicious sign-in."
    ],
    "generic": [
      "Validate whether the authentication source is expected.",
      "Review recent successful and failed authentication events.",
      "Check privilege changes after authentication.",
      "Review access to sensitive systems."
    ]
  },
  "evidence_to_collect": [
    "User principal name",
    "Source IP",
    "Location",
    "Device ID",
    "User agent",
    "Application accessed",
    "Sign-in result",
    "MFA status",
    "Token activity",
    "Group or role changes",
    "Mailbox rule changes",
    "OAuth consent grants"
  ],
  "response_actions": [
    {
      "name": "Revoke user sessions",
      "category": "Containment",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "Microsoft Graph",
      "notes": "Safe for most confirmed suspicious sessions, but consider business impact for executives and privileged users.\n"
    },
    {
      "name": "Reset password",
      "category": "Containment",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Entra ID",
      "notes": "Requires approval because it can disrupt legitimate user activity."
    },
    {
      "name": "Temporarily disable account",
      "category": "Containment",
      "risk": "High",
      "automation_safe": false,
      "approval_required": true,
      "tool": "Entra ID",
      "notes": "Use when compromise is confirmed or the account is actively being abused."
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "Recent user sign-ins",
        "description": "Review successful and failed sign-ins for the user.",
        "query": "SigninLogs\n| where UserPrincipalName =~ \"<user>\"\n| where TimeGenerated > ago(24h)\n| project TimeGenerated, UserPrincipalName, IPAddress, Location, AppDisplayName, ResultType, ResultDescription\n"
      },
      {
        "name": "User audit activity",
        "description": "Review changes involving the user.",
        "query": "AuditLogs\n| where TargetResources has \"<user>\"\n| where TimeGenerated > ago(24h)\n| project TimeGenerated, OperationName, InitiatedBy, TargetResources\n"
      }
    ],
    "spl": [
      {
        "name": "Recent authentication events",
        "description": "Review recent authentication events in Splunk.",
        "query": "index=authentication user=\"<user>\" earliest=-24h\n"
      }
    ],
    "esql": [
      {
        "name": "Recent authentication events",
        "description": "Review recent authentication events in Elastic.",
        "query": "FROM logs-auth*\n| WHERE user.name == \"<user>\"\n"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Create ServiceNow SecOps task.",
      "Run enrichment queries.",
      "Add suspicious IP to watchlist for review."
    ],
    "approval_required": [
      "Disable account.",
      "Reset password.",
      "Revoke sessions for privileged users.",
      "Block IP tenant-wide."
    ]
  },
  "escalation_criteria": [
    "Privileged account involved.",
    "Break-glass account involved.",
    "Successful sign-in from unfamiliar country.",
    "MFA method was changed.",
    "OAuth grant was added.",
    "Mailbox forwarding rule was created.",
    "Access to sensitive data occurred after sign-in.",
    "Service principal or managed identity involved."
  ],
  "false_positive_considerations": [
    "User travel.",
    "VPN egress.",
    "Known corporate proxy.",
    "Approved admin maintenance.",
    "Red team activity.",
    "New device enrolment.",
    "Conditional Access policy changes."
  ],
  "confluence": {
    "title": "T1078 - Valid Accounts Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}