value:  Sandworm Team has used stolen credentials to access administrative accounts within the domain. ;; If Shamoon cannot access shares using current privileges it attempts access using hard coded domain-specific credentials gathered earlier in the intrusion. ;; TA505 has used stolen domain admin accounts to compromise additional hosts. ;; Threat Group-1314 actors used compromised domain credentials for the victim's endpoint management platform Altiris to move laterally. ;; Wizard Spider has used administrative accounts including Domain Admin to move laterally within a victim network.
name: Valid Accounts: Domain Accounts