T1078, “Valid Accounts,” is a MITRE ATT&CK technique describing an adversary’s use of legitimate user or service accounts to gain or maintain access. Rather than exploiting a vulnerability, an attacker may use stolen, guessed, or otherwise obtained credentials, or misuse an account they can already access.
Because activity is authenticated, account misuse can resemble normal work and support actions such as accessing email, moving through a network, or using authorized services. Defenders can reduce risk with multi-factor authentication, least-privilege permissions, and monitoring for unusual sign-in patterns, devices, locations, or actions. For sensitive requests, independent verification helps distinguish a valid login from a legitimate business purpose.