Threadlinqs IntelligenceStart free

ATT&CK techniqueInitial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)

T1078 Valid Accounts

Initial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)Enterprise

As of 2026-10-05, T1078 (Valid Accounts) appears in 718 tracked threats, first reported 2025-10-13 and most recently 2026-10-04, with linked actors including TeamPCP, ShinyHunters, APT38; it most often appears alongside T1190 (Exploit Public-Facing Application).

Tracked threats
718301 critical, 331 high, 73 medium, 4 low
First seen
2025-10-13
Last seen
2026-10-04
Threat actors
154In the threats using it
Detection rules
985Blue tier and above

Data as of:

Activity timeline

T1078 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 245 reports, and 717 of the 718 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1078 Valid Accounts is catalogued by MITRE ATT&CK under the Initial Access and Persistence and Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix. Threadlinqs maps 718 of 2623 tracked threats (27.4%) to it; by severity that is 301 critical, 331 high, 73 medium, 4 low.

Threats that use T1078 most often also use T1190 Exploit Public-Facing Application (411 threats), T1059 Command and Scripting Interpreter (367 threats), T1005 Data from Local System (317 threats), T1071 Application Layer Protocol (265 threats), T1552 Unsecured Credentials (260 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

154 tracked threat actors appear in the threats that use T1078; the most frequent are TeamPCP (20), ShinyHunters (17), APT38 (14), Stardust Chollima (12), Qilin (11).

Mitigations

MITRE ATT&CK lists 8 mitigations for T1078.

Data sources

Telemetry that can reveal T1078, per MITRE ATT&CK.

  • Logon Session — Logon Session Creation, Logon Session Metadata
  • User Account — User Account Authentication

Threat actors using it

Tracked threats

The 30 most recent of 718 tracked threats that use T1078.

Detection coverage

Threadlinqs maintains 985 detection rules mapped to T1078 (SPL 341, KQL 360, Sigma 282, other 2). Rule content is available to Blue tier accounts and above; this page shows counts only.

985 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques