M1018: User Account Management
User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:
Enforcing the Principle of Least Privilege
- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.
Implementing Strong Password Policies
- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.
Managing Dormant and Orphaned Accounts
- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.
Account Lockout Policies
- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.
Multi-Factor Authentication (MFA) for High-Risk Accounts
- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.
Restricting Interactive Logins
- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.
*Tools for Implementation*
Built-in Tools:
- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.
Identity and Access Management (IAM) Tools:
- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.
Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.
Security context for executives and security teams
User Account Management is a foundational mitigation because many ATT&CK behaviors depend on usable credentials, excessive privilege, dormant accounts, or weak account lifecycle controls. For leaders, the practical question is not whether an identity policy exists, but whether account creation, privilege assignment, password policy, lockout, MFA for high-risk accounts, and deactivation are enforced consistently enough to reduce lateral movement, persistence, cloud access misuse, and administrative abuse.
Executive priority
Prioritize this as an identity governance and resilience control. The relationship context ties this mitigation to Valid Accounts, Remote Services, RDP, SSH, direct cloud VM access, scheduled jobs, software deployment tools, network device CLI use, traffic duplication, and other behaviors where account misuse can become execution, lateral movement, persistence, exfiltration, or stealth. Executives should ask for evidence that privileged and high-risk accounts are known, least privilege is reviewed, dormant and orphaned accounts are removed, MFA is enforced where required, and account lifecycle actions are auditable across enterprise, cloud, and administrative systems.
Technical view
SOC, IAM, cloud, and IR teams should validate the full account lifecycle: creation, modification, privilege changes, authentication, lockout, MFA enrollment/enforcement, interactive logon restrictions, inactivity handling, and deactivation. Because ATT&CK provides no official detection for M1018, detection engineering should be driven by the related techniques: anomalous use of valid accounts, remote service logons such as RDP/SSH/cloud VM connection methods, account names that resemble legitimate accounts, scheduled task/job creation by unexpected users, privileged use of WMI or software deployment tools, network device CLI access, and unauthorized changes to traffic mirroring or sniffing-relevant configurations.
Likely telemetry
- Identity provider and directory audit logs for account creation, modification, disablement, deletion, group membership, and role changes
- Authentication logs including successful and failed logons, lockouts, password changes, password resets, and MFA events
- Privileged account management records, where present, for checkout, session use, approval, and privileged command activity
- Endpoint and server logon records for interactive and remote access, including RDP, SSH, WMI, and administrative sessions
- Cloud IAM and cloud compute access logs for role assignment, console access, API-driven account changes, and direct VM connection activity
Detection direction
- Confirm that account lifecycle and privilege-change events are collected from authoritative identity stores, not only from endpoints.
- Tune for risky account states: dormant accounts becoming active, orphaned accounts, unexpected privilege grants, unusual MFA changes, repeated lockouts, and newly created accounts with names similar to legitimate users.
- Correlate account activity with related ATT&CK behaviors, especially remote services, valid account use, scheduled jobs, cloud VM connections, software deployment tools, and network device administration.
- Separate legitimate administrative activity from risk by using expected owners, approved change windows, source systems, role baselines, and ticket or approval context where available.
- Validate cloud and hybrid identity blind spots, including accounts that exist only in SaaS, IaaS, identity providers, local systems, containers, ESXi, or network devices.
Mitigation priorities
- Establish authoritative ownership for user, service, local, cloud, and privileged accounts before tuning alerts or enforcing exceptions.
- Apply least privilege and recurring access reviews, with priority on administrative, remote access, software deployment, cloud, and network device accounts.
- Enforce strong password, lockout, and reuse controls consistent with organizational policy, while monitoring for operational side effects such as help desk spikes or service disruption.
- Require MFA for administrative and high-risk accounts, and verify enforcement rather than enrollment alone.
- Automate inactivity and orphan-account handling so dormant access is disabled or removed through repeatable workflow.
Additional notes and limits
This mitigation is broad and identity-centric. Its value is highest when mapped to concrete account populations and administrative paths: domain accounts, local accounts, cloud accounts, remote services, privileged tools, network devices, and scheduling mechanisms. Glexia would use this object as a control-validation anchor for identity governance, SOC detection engineering, cloud security review, incident response readiness, and audit evidence collection.
MITRE provides no official detection text for M1018, and the mitigation object itself does not specify platforms or tactics. Platform and tactic relevance is inferred only from the supplied relationships to techniques. Local architecture, identity sources, logging configuration, retention, and administrative processes are required to determine actual coverage or gaps.
Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.
User Account Management
User Account Management involves implementing and enforcing policies for the lifecycle of user accounts, including creation, modification, and deactivation. Proper account management reduces the attack surface by limiting unauthorized access, managing account privileges, and ensuring accounts are used according to organizational policies. This mitigation can be implemented through the following measures:
Enforcing the Principle of Least Privilege
- Implementation: Assign users only the minimum permissions required to perform their job functions. Regularly audit accounts to ensure no excess permissions are granted. - Use Case: Reduces the risk of privilege escalation by ensuring accounts cannot perform unauthorized actions.
Implementing Strong Password Policies
- Implementation: Enforce password complexity requirements (e.g., length, character types). Require password expiration every 90 days and disallow password reuse. - Use Case: Prevents adversaries from gaining unauthorized access through password guessing or brute force attacks.
Managing Dormant and Orphaned Accounts
- Implementation: Implement automated workflows to disable accounts after a set period of inactivity (e.g., 30 days). Remove orphaned accounts (e.g., accounts without an assigned owner) during regular account audits. - Use Case: Eliminates dormant accounts that could be exploited by attackers.
Account Lockout Policies
- Implementation: Configure account lockout thresholds (e.g., lock accounts after five failed login attempts). Set lockout durations to a minimum of 15 minutes. - Use Case: Mitigates automated attack techniques that rely on repeated login attempts.
Multi-Factor Authentication (MFA) for High-Risk Accounts
- Implementation: Require MFA for all administrative accounts and high-risk users. Use MFA mechanisms like hardware tokens, authenticator apps, or biometrics. - Use Case: Prevents unauthorized access, even if credentials are stolen.
Restricting Interactive Logins
- Implementation: Restrict interactive logins for privileged accounts to specific secure systems or management consoles. Use group policies to enforce logon restrictions. - Use Case: Protects sensitive accounts from misuse or exploitation.
*Tools for Implementation*
Built-in Tools:
- Microsoft Active Directory (AD): Centralized account management and RBAC enforcement. - Group Policy Object (GPO): Enforce password policies, logon restrictions, and account lockout policies.
Identity and Access Management (IAM) Tools:
- Okta: Centralized user provisioning, MFA, and SSO integration. - Microsoft Azure Active Directory: Provides advanced account lifecycle management, role-based access, and conditional access policies.
Privileged Account Management (PAM): - CyberArk, BeyondTrust, Thycotic: Manage and monitor privileged account usage, enforce session recording, and JIT access.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates.
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.