value:  PROMETHIUM has created admin accounts on a compromised host. ;; Stolen Pencil has a tool to add a Windows admin account in order to allow them to ensure continued access via RDP. ;; Tropic Trooper has used known administrator account credentials to execute the backdoor directly. ;; Turla has abused local accounts that have the same password across the victim’s network. ;; Umbreon creates valid local users to provide access to the system.
name: Valid Accounts: Local Accounts