T1078Valid Accounts
T1078 — Valid Accounts is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 86 detection use cases covering it and 21 threat-intel articles citing it.
Defense EvasionPersistencePrivilege EscalationInitial Access
86Use cases
21Articles
4Sub-techniques
4Tactics
Sub-techniques (4)
Use cases covering this technique (86)
1Password impossible-travel sign-in Atlassian administrator impersonating user Auth0 anomalous attack-protection event spike AWS Console login without MFA + impossible travel Credential-stuffing attack on application GitHub branch protection disabled with force-push bypass GitLab password reset from suspicious IP Impossible travel from application business-logic event [WEEKLY] Post-Auth Privilege Boundary Crossing on Edge/Management Appliances (low-priv -> admin within 10m) [WEEKLY] Sub-admin grants Owner/Administrator role then grantee signs in from a different source within 60 minutes Cisco IOS XE WebUI Login From IOSd Local Port Cisco IOS XE WebUI Programmatic Configuration ESXi Account Modified ESXi External Root Login Activity ESXi Shared or Stolen Root Account ESXi User Granted Admin Role M365 Copilot Application Usage Pattern Anomalies M365 Copilot Session Origin Anomalies Okta Risk Threshold Exceeded PingID Multiple Failed MFA Requests For User Splunk User Enumeration Attempt Zoom High Video Latency ASL AWS SAML Update identity provider AWS Bedrock Invoke Model Access Denied AWS SAML Update identity provider Azure AD Multiple AppIDs and UserAgents Authentication Spike Cloud API Calls From Previously Unseen User Roles Cloud Provisioning Activity From Previously Unseen City Cloud Provisioning Activity From Previously Unseen Country Cloud Provisioning Activity From Previously Unseen IP Address Cloud Provisioning Activity From Previously Unseen Region GCP Detect gcploit framework Geographic Improbable Location O365 Multiple AppIDs and UserAgents Authentication Spike Okta Non-Standard VPN Usage Linux Usermod Root UID Set Unusual Number of Computer Service Tickets Requested Unusual Number of Remote Endpoint Authentication Events Windows Azure PowerShell Module Installation Via PowerShell Script Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script Windows Large Number of Computer Service Tickets Requested Windows Multiple Account Passwords Changed Windows Multiple Accounts Deleted Windows Multiple Accounts Disabled Cisco IOS Suspicious Privileged Account Creation Cisco Privileged Account Creation with HTTP Command Execution Cisco Privileged Account Creation with Suspicious SSH Activity Cisco Secure Firewall - High Priority Intrusion Classification ASL AWS CreateAccessKey aws detect attach to role policy aws detect permanent key creation aws detect role creation aws detect sts assume role abuse AWS SAML Access by Provider User and Principal GCP Detect accounts with high risk roles by project GCP Detect high risk permissions by resource and account gcp detect oauth token abuse Web Fraud - Anomalous User Clickspeed [LLM] new-api CVE-2026-64859: root-only /api/option config change following user-record access from same IP [LLM] Stolen DGFiP SPDC account used from multiple source IPs (valid-account + MFA-bypass access) [LLM] SharePoint CVE-2026-55040 chain: metadata recon then post-bypass API calls from one external IP [LLM] Craft CMS passkey assertion replay: repeated POST to users/login-with-passkey [LLM] Craft passkey replay: identical request-body size reposted to login-with-passkey [LLM] Pterodactyl Wings daemon-token file (/etc/pterodactyl/config.yml) read by non-Wings process [LLM] OpenDJ SASL PLAIN bind invoking proxied authorization (authzid) — impersonation [LLM] OpenDJ proxied-auth fan-out — one source assuming many distinct authz identities [LLM] Gitea same-user auth failure + success from different IPs within 2 minutes [LLM] Anomalous EnvoyExtensionPolicy submitter / suspicious policy name [LLM] First-seen SOAP client on MantisBT mantisconnect.php (new source, post-bypass admin activity) [LLM] n8n-MCP cross-tenant workflow version read/enumeration via n8n_workflow_versions (CVE-2026-54052) [LLM] n8n-MCP vulnerable multi-tenant config exposure (ENABLE_MULTI_TENANT without version-tool mitigation) [LLM] FacturaScripts account takeover: /AdminPlugins access following filter[] SQLi from same source [LLM] FacturaScripts CVE-2026-47677: high-volume brute-force of /login two-factor-validation endpoint [LLM] FacturaScripts CVE-2026-47677: successful 2FA bypass — 302 session issuance following a brute-force burst [LLM] FileBrowser proxy-auth header forgery naming admin on /api/login [LLM] FileBrowser post-bypass admin API actions (DELETE/PUT /api/users, /api/settings) [LLM] FileBrowser identity-cycling: 3+ user identities from one untrusted source in 5 min [LLM] External browser process connects to SiYuan kernel loopback admin port 127.0.0.1:6806 [LLM] phpBB CVE-2026-48611 auth bypass via login_link auth_provider=apache [LLM] phpBB CVE-2026-48611 post-exploit ACP access from exploiting IP [LLM] HTTP Basic Authorization header sent to phpBB login_link endpoint [LLM] phpBB ACP access from a source IP with no prior login (CVE-2026-48611 session hijack) [LLM] GitHub bulk git tag force-push by single actor across multiple org repos [LLM] Next.js CVE-2025-29927 middleware bypass via x-middleware-subrequest header [LLM] Git checkout of compromised tj-actions/changed-files commit on runner host [LLM] Reuse of CircleCI-exfiltrated secrets / stolen SSO session from breach attacker IPsArticles citing this technique (21)
crit [GHSA / CRITICAL] CVE-2026-73644: OpenDJ SASL PLAIN authzid bypassing the proxy ACI scope check art-197