Use Valid Accounts

Adversaries obtain and use credentials for existing local, domain, default, or cloud accounts to access systems and services. Valid accounts can support initial access, persistence, privilege escalation, or defense evasion by bypassing access controls on systems and remote services such as VPNs, Outlook Web Access, remote desktop, and network devices. Adversaries may also abuse inactive accounts or default credentials.