M0926 Privileged Account Management

Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.

Techniques Addressed by Mitigation

Domain	ID	Name	Use
ics	T0809	Data Destruction	Minimize permissions and access for service accounts to limit the information that may be impacted by malicious users or software. ¹

ics	T0811	Data from Information Repositories	Minimize permissions and access for service accounts to limit the information that may be exposed or collected by malicious users or software. ¹

ics	T0819	Exploit Public-Facing Application	Use least privilege for service accounts. ² ¹

ics	T0866	Exploitation of Remote Services	Minimize permissions and access for service accounts to limit impact of exploitation. ²

ics	T0842	Network Sniffing	Restrict root or administrator access on user accounts to limit the ability to capture promiscuous traffic on a network through common packet capture tools. ¹

ics	T0859	Valid Accounts	Audit domain and local accounts and their permission levels routinely to look for situations that could allow an adversary to gain system wide access with stolen privileged account credentials. ³ ⁴These audits should also identify if default accounts have been enabled, or if new local accounts are created that have not be authorized. Follow best practices for design and administration of an enterprise network to limit privileged account use across administrative tiers. ⁵