# T1078.003_local-accounts > Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. - Skill: `cyberstrikeus/t1078-003-local-accounts` (Agent Skill) - Install (CLI): `npx skillmds@latest add cyberstrikeus/t1078-003-local-accounts` - Raw SKILL.md: https://api.skillmd.com/api/skills/cyberstrikeus/t1078-003-local-accounts/raw - Safety review: PASS (external: skill-scanner PASS, skillspector PASS) - Works with: Claude Code, Claude.ai, OpenAI Codex - Category: Coding & Dev Tools - Author: cyberstrikeus (https://skillmd.com/u/cyberstrikeus) - Updated: 2026-09-17 - Page: https://skillmd.com/skills/cyberstrikeus/t1078-003-local-accounts --- # T1078.003 Local Accounts > **Sub-technique of:** T1078 ## High-Level Description Adversaries may obtain and abuse credentials of a local account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Local accounts are those configured by an organization for use by users, remote support, services, or for administration on a single system or service. Local Accounts may also be abused to elevate privileges and harvest credentials through OS Credential Dumping. Password reuse may allow the abuse of local accounts across a set of machines on a network for the purposes of Privilege Escalation and Lateral Movement. ## Kill Chain Phase - Defense Evasion (TA0005) - Persistence (TA0003) - Privilege Escalation (TA0004) - Initial Access (TA0001) **Platforms:** Linux, macOS, Windows, Containers, Network Devices, ESXi ## What to Check - [ ] Identify if Local Accounts technique is applicable to target environment - [ ] Check Linux systems for indicators of Local Accounts - [ ] Check macOS systems for indicators of Local Accounts - [ ] Check Windows systems for indicators of Local Accounts - [ ] Verify mitigations are bypassed or absent (4 known mitigations) - [ ] Assess detection coverage (1 detection strategies) ## How to Test ### Atomic Red Team Tests The following tests are from [Atomic Red Team](https://github.com/redcanaryco/atomic-red-team) and provide actionable ways to test this technique: ### Atomic Test 1: Create local account with admin privileges After execution the new account will be active and added to the Administrators group **Supported Platforms:** windows **Elevation Required:** Yes ```cmd net user art-test /add net user art-test #{password} net localgroup administrators art-test /add ``` ### Atomic Test 2: Create local account with admin privileges - MacOS After execution the new account will be active and added to the Administrators group **Supported Platforms:** macos **Elevation Required:** Yes ```bash dscl . -create /Users/AtomicUser dscl . -create /Users/AtomicUser UserShell /bin/bash dscl . -create /Users/AtomicUser RealName "Atomic User" dscl . -create /Users/AtomicUser UniqueID 503 dscl . -create /Users/AtomicUser PrimaryGroupID 503 dscl . -create /Users/AtomicUser NFSHomeDirectory /Local/Users/AtomicUser dscl . -passwd /Users/AtomicUser mySecretPassword dscl . -append /Groups/admin GroupMembership AtomicUser ``` ### Atomic Test 3: Create local account with admin privileges using sysadminctl utility - MacOS After execution the new account will be active and added to the Administrators group **Supported Platforms:** macos **Elevation Required:** Yes ```bash sysadminctl interactive -addUser art-tester -fullName ARTUser -password !pass123! -admin ``` ### Atomic Test 4: Enable root account using dsenableroot utility - MacOS After execution the current/new user will have root access **Supported Platforms:** macos **Elevation Required:** Yes ```bash dsenableroot #current user dsenableroot -u art-tester -p art-tester -r art-root #new user ``` ### Atomic Test 5: Add a new/existing user to the admin group using dseditgroup utility - macOS After execution the current/new user will be added to the Admin group **Supported Platforms:** macos **Elevation Required:** Yes ```bash dseditgroup -o edit -a art-user -t user admin ``` ### Manual Testing If Atomic Red Team tests are not applicable, manually verify the technique by: 1. **Identify Attack Surface**: Determine if the target environment is susceptible to Local Accounts by examining the target platforms (Linux, macOS, Windows). 2. **Assess Existing Defenses**: Review whether mitigations for T1078.003 are in place. If defenses are absent or misconfigured, this technique may be exploitable. 3. **Execute Test**: Use tools and methods described in the MITRE ATT&CK page and external references below. ## Remediation Guide ### M1026 Privileged Account Management Audit local accounts permission levels routinely to look for situations that could allow an adversary to gain wide access by obtaining credentials of a privileged account. Limit the usage of local administrator accounts to be used for day-to-day operations that may expose them to potential adversaries. For example, audit the use of service accounts in Kubernetes, and avoid automatically granting them access to the Kubernetes API if this is not required. Implementing LAPS may also help prevent reuse of local administrator credentials across a domain. ### M1032 Multi-factor Authentication Enable multi-factor authentication (MFA) for local accounts to add an extra layer of protection against credential theft and misuse. MFA can be implemented using methods like mobile-based authenticators or hardware tokens, even in environments that do not rely on domain controllers or cloud services. This additional security measure can help reduce the risk of adversaries gaining unauthorized access to local systems and resources. ### M1027 Password Policies Ensure that local administrator accounts have complex, unique passwords across all systems on the network. ### M1018 User Account Management Enforce user account management practices for local accounts to limit access and remove inactive or unused accounts. By doing so, you reduce the attack surface available to adversaries and prevent unauthorized access to local systems. ## Detection ### Detection of Local Account Abuse for Initial Access and Persistence ## Risk Assessment | Finding | Severity | Impact | | ----------------------------------- | -------- | --------------- | | Local Accounts technique applicable | High | Defense Evasion | ## CWE Categories | CWE ID | Title | | ------- | ---------------------------- | | CWE-693 | Protection Mechanism Failure | ## References - [Atomic Red Team - T1078.003](https://github.com/redcanaryco/atomic-red-team/tree/master/atomics/T1078.003) - [MITRE ATT&CK - T1078.003](https://attack.mitre.org/techniques/T1078/003)