T1078 Valid Accounts | DetectionCode

About this technique

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

In some cases, adversaries may abuse inactive accounts: for example, those belonging to individuals who are no longer part of an organization. Using these accounts may allow the adversary to evade detection, as the original account user will not be present to identify any anomalous activity taking place on their account.

The overlap of permissions for local, domain, and cloud accounts across a network of systems is of concern because the adversary may be able to pivot across accounts and systems to reach a high level of access (i.e., domain or enterprise administrator) to bypass access controls set within the enterprise.

Detection rules208

Rules on DetectionCode tagged with T1078 or one of its sub-techniques.

Sigma102

Rule	Level	Log source	Technique
Win Susp Computer Name Containing Samtheadmin	critical	windows / NULL	T1078
Account Created And Deleted Within A Close Time Frame	high	azure / NULL	T1078
Activity From Anonymous IP Address	high	azure / NULL	T1078
Application AppID Uri Configuration Changes	high	azure / NULL	T1078.004
Application URI Configuration Changes	high	azure / NULL	T1078.004
Atypical Travel	high	azure / NULL	T1078
AWS IAM S3Browser LoginProfile Creation	high	aws / NULL	T1078.004
AWS IAM S3Browser Templated S3 Bucket Policy Creation	high	aws / NULL	T1078.004
AWS IAM S3Browser User or AccessKey Creation	high	aws / NULL	T1078.004
Azure AD Threat Intelligence	high	azure / NULL	T1078
Azure Login Bypassing Conditional Access Policies	high	m365 / NULL	T1078
Azure Subscription Permission Elevation Via ActivityLogs	high	azure / NULL	T1078.004
Azure Subscription Permission Elevation Via AuditLogs	high	azure / NULL	T1078
Changes To PIM Settings	high	azure / NULL	T1078.004
External Remote SMB Logon from Public IP	high	windows / NULL	T1078
Impossible Travel	high	azure / NULL	T1078
Invalid PIM License	high	azure / NULL	T1078
Malicious Usage Of IMDS Credentials Outside Of AWS Infrastructure	high	aws / NULL	T1078 T1078.002
New Country	high	azure / NULL	T1078
Okta New Admin Console Behaviours	high	okta / NULL	T1078.004
OpenCanary - SSH Login Attempt	high	opencanary / application	T1078
OpenCanary - SSH New Connection Attempt	high	opencanary / application	T1078
OpenCanary - Telnet Login Attempt	high	opencanary / application	T1078
PIM Alert Setting Changes To Disabled	high	azure / NULL	T1078
PIM Approvals And Deny Elevation	high	azure / NULL	T1078.004
Potential MFA Bypass Using Legacy Client Authentication	high	azure / NULL	T1078.004
Roles Activated Too Frequently	high	azure / NULL	T1078
Roles Activation Doesn't Require MFA	high	azure / NULL	T1078
Roles Are Not Being Used	high	azure / NULL	T1078
Roles Assigned Outside PIM	high	azure / NULL	T1078
Sign-in Failure Due to Conditional Access Requirements Not Met	high	azure / NULL	T1078.004
Sign-ins from Non-Compliant Devices	high	azure / NULL	T1078.004
Stale Accounts In A Privileged Role	high	azure / NULL	T1078
Suspicious Browser Activity	high	azure / NULL	T1078
Suspicious SignIns From A Non Registered Device	high	azure / NULL	T1078
Temporary Access Pass Added To An Account	high	azure / NULL	T1078.004
Too Many Global Admins	high	azure / NULL	T1078
Unfamiliar Sign-In Properties	high	azure / NULL	T1078
Use of Legacy Authentication Protocols	high	azure / NULL	T1078.004
User Added To Privilege Role	high	azure / NULL	T1078.004
Users Added to Global or Device Admin Roles	high	azure / NULL	T1078.004
Account Disabled or Blocked for Sign in Attempts	medium	azure / NULL	T1078.004
Account Tampering - Suspicious Failed Logon Reasons	medium	windows / NULL	T1078
Application Using Device Code Authentication Flow	medium	azure / NULL	T1078
Applications That Are Using ROPC Authentication Flow	medium	azure / NULL	T1078
Authentications To Important Apps Using Single Factor Authentication	medium	azure / NULL	T1078
AWS Key Pair Import Activity	medium	aws / NULL	T1078
AWS Root Credentials	medium	aws / NULL	T1078.004
AWS SAML Provider Deletion Activity	medium	aws / NULL	T1078.004
AWS Successful Console Login Without MFA	medium	aws / NULL	T1078.004
AWS Suspicious SAML Activity	medium	aws / NULL	T1078
Azure Domain Federation Settings Modified	medium	azure / NULL	T1078
Azure Kubernetes Admission Controller	medium	azure / NULL	T1078
Azure Unusual Authentication Interruption	medium	azure / NULL	T1078
Bitbucket User Login Failure	medium	bitbucket / NULL	T1078.004
Bitlocker Key Retrieval	medium	azure / NULL	T1078.004
Device Registration or Join Without MFA	medium	azure / NULL	T1078.004
DMSA Service Account Created in Specific OUs - PowerShell	medium	windows / ps_script	T1078.002
External Remote RDP Logon from Public IP	medium	windows / NULL	T1078
Failed Logon From Public IP	medium	windows / NULL	T1078
Github SSH Certificate Configuration Changed	medium	github / NULL	T1078.004
Google Cloud Kubernetes Admission Controller	medium	gcp / NULL	T1078
Google Workspace Government Attack Warning	medium	gcp / NULL	T1078
Guest User Invited By Non Approved Inviters	medium	azure / NULL	T1078.004
Guest Users Invited To Tenant By Non Approved Inviters	medium	azure / NULL	T1078
Increased Failed Authentications Of Any Type	medium	azure / NULL	T1078
Kubernetes Admission Controller Modification	medium	kubernetes / NULL	T1078
Login to Disabled Account	medium	azure / NULL	T1078.004
Logon from a Risky IP Address	medium	m365 / NULL	T1078
Microsoft 365 - Impossible Travel Activity	medium	m365 / NULL	T1078
Multifactor Authentication Denied	medium	azure / NULL	T1078.004
Multifactor Authentication Interrupted	medium	azure / NULL	T1078.004
New DMSA Service Account Created in Specific OUs	medium	windows / process_creation	T1078.002
Password Provided In Command Line Of Net.EXE	medium	windows / process_creation	T1078
Password Reset By User Account	medium	azure / NULL	T1078.004
Privileged Account Creation	medium	azure / NULL	T1078.004
Root Account Enable Via Dsenableroot	medium	macos / process_creation	T1078 T1078.001 T1078.003
Successful Authentications From Countries You Do Not Operate Out Of	medium	azure / NULL	T1078.004
Suspicious Computer Machine Password by PowerShell	medium	windows / ps_module	T1078
Suspicious Login Activity Classified By Google	medium	gcp / NULL	T1078.004
Suspicious Remote Logon with Explicit Credentials	medium	windows / NULL	T1078
User Access Blocked by Azure Conditional Access	medium	azure / NULL	T1078.004
User Added To Admin Group Via Dscl	medium	macos / process_creation	T1078.003
User Added To Admin Group Via DseditGroup	medium	macos / process_creation	T1078.003
User Added To Admin Group Via Sysadminctl	medium	macos / process_creation	T1078.003
User Added to an Administrator's Azure AD Role	medium	azure / NULL	T1078
User Added to Local Administrator Group	medium	windows / NULL	T1078
User State Changed From Guest To Member	medium	azure / NULL	T1078.004
Users Authenticating To Other Azure AD Tenants	medium	azure / NULL	T1078.004
Admin User Remote Logon	low	windows / NULL	T1078.001 T1078.002 T1078.003
Azure AD Only Single Factor Authentication Required	low	azure / NULL	T1078.004
Cisco BGP Authentication Failures	low	cisco / NULL	T1078
Cisco LDP Authentication Failures	low	cisco / NULL	T1078
DMSA Link Attributes Modified	low	windows / ps_script	T1078.002
Failed Authentications From Countries You Do Not Operate Out Of	low	azure / NULL	T1078.004
Github New Secret Created	low	github / NULL	T1078.004
Github Self Hosted Runner Changes Detected	low	github / NULL	T1078.004
Guest Account Enabled Via Sysadminctl	low	macos / process_creation	T1078 T1078.001
Huawei BGP Authentication Failures	low	huawei / NULL	T1078
Juniper BGP Missing MD5	low	juniper / NULL	T1078
Measurable Increase Of Successful Authentications	low	azure / NULL	T1078
Sign-ins by Unknown Devices	low	azure / NULL	T1078.004

Splunk106

Rule	Type	Risk	Data source	Technique
Abnormally High AWS Instances Launched by User	Anomaly	NULL		T1078.004
Abnormally High AWS Instances Launched by User - MLTK	Anomaly	NULL		T1078.004
Abnormally High AWS Instances Terminated by User	Anomaly	NULL		T1078.004
Abnormally High AWS Instances Terminated by User - MLTK	Anomaly	NULL		T1078.004
Abnormally High Number Of Cloud Infrastructure API Calls	Anomaly	NULL	AWS CloudTrail	T1078.004
Abnormally High Number Of Cloud Instances Destroyed	Anomaly	NULL	AWS CloudTrail	T1078.004
Abnormally High Number Of Cloud Instances Launched	Anomaly	NULL	AWS CloudTrail	T1078.004
Abnormally High Number Of Cloud Security Group API Calls	Anomaly	NULL	AWS CloudTrail	T1078.004
ASL AWS Create Policy Version to allow all resources	TTP	NULL	ASL AWS CloudTrail	T1078.004
ASL AWS CreateAccessKey	Hunting	NULL		T1078
ASL AWS SAML Update identity provider	TTP	NULL	ASL AWS CloudTrail	T1078
AWS Bedrock Invoke Model Access Denied	TTP	NULL	AWS CloudTrail	T1078
AWS Create Policy Version to allow all resources	TTP	NULL	AWS CloudTrail CreatePolicyVersion	T1078.004
aws detect attach to role policy	Hunting	NULL		T1078
aws detect permanent key creation	Hunting	NULL		T1078
aws detect role creation	Hunting	NULL		T1078
aws detect sts assume role abuse	Hunting	NULL		T1078
AWS SAML Access by Provider User and Principal	Anomaly	NULL	AWS CloudTrail AssumeRoleWithSAML	T1078
AWS SAML Update identity provider	TTP	NULL	AWS CloudTrail UpdateSAMLProvider	T1078
AWS SetDefaultPolicyVersion	TTP	NULL	AWS CloudTrail SetDefaultPolicyVersion	T1078.004
AWS Successful Single-Factor Authentication	TTP	NULL	AWS CloudTrail ConsoleLogin	T1078.004
Azure AD Authentication Failed During MFA Challenge	TTP	NULL	Azure Active Directory	T1078.004
Azure AD Multiple AppIDs and UserAgents Authentication Spike	Anomaly	NULL	Azure Active Directory Sign-in activity	T1078
Azure AD Multiple Failed MFA Requests For User	TTP	NULL	Azure Active Directory Sign-in activity	T1078.004
Azure AD Service Principal Authentication	TTP	NULL	Azure Active Directory Sign-in activity	T1078.004
Azure AD Successful PowerShell Authentication	TTP	NULL	Azure Active Directory	T1078.004
Azure AD Successful Single-Factor Authentication	TTP	NULL	Azure Active Directory	T1078.004
Azure Runbook Webhook Created	TTP	NULL	Azure Audit Create or Update an Azure Automation webhook	T1078.004
Cisco ASA - New Local User Account Created	Anomaly	NULL	Cisco ASA Logs	T1078.003
Cisco ASA - User Privilege Level Change	Anomaly	NULL	Cisco ASA Logs	T1078.003
Cisco IOS Suspicious Privileged Account Creation	Anomaly	NULL	Cisco IOS Logs	T1078
Cisco IOS XE WebUI Login From IOSd Local Port	TTP	NULL	Cisco IOS Logs	T1078
Cisco IOS XE WebUI Programmatic Configuration	Anomaly	NULL	Cisco IOS Logs	T1078
Cisco Privileged Account Creation with HTTP Command Execution	Correlation	NULL		T1078
Cisco Privileged Account Creation with Suspicious SSH Activity	Correlation	NULL		T1078
Cisco Secure Firewall - High Priority Intrusion Classification	TTP	NULL	Cisco Secure Firewall Threat Defense Intrusion Event	T1078
Cloud API Calls From Previously Unseen User Roles	Anomaly	NULL	AWS CloudTrail	T1078
Cloud Compute Instance Created By Previously Unseen User	Anomaly	NULL	AWS CloudTrail	T1078.004
Cloud Instance Modified By Previously Unseen User	Anomaly	NULL	AWS CloudTrail	T1078.004
Cloud Provisioning Activity From Previously Unseen City	Anomaly	NULL	AWS CloudTrail	T1078
Cloud Provisioning Activity From Previously Unseen Country	Anomaly	NULL	AWS CloudTrail	T1078
Cloud Provisioning Activity From Previously Unseen IP Address	Anomaly	NULL	AWS CloudTrail	T1078
Cloud Provisioning Activity From Previously Unseen Region	Anomaly	NULL	AWS CloudTrail	T1078
Detect AWS API Activities From Unapproved Accounts	Hunting	NULL		T1078.004
Detect Excessive Account Lockouts From Endpoint	Anomaly	NULL		T1078.002
Detect Excessive User Account Lockouts	Anomaly	NULL		T1078.003
Detect new API calls from user roles	Anomaly	NULL		T1078.004
Detect new user AWS Console Login	Hunting	NULL		T1078.004
Detect Spike in AWS API Activity	Anomaly	NULL		T1078.004
Detect Spike in Security Group Activity	Anomaly	NULL		T1078.004
EC2 Instance Modified With Previously Unseen User	Anomaly	NULL		T1078.004
EC2 Instance Started With Previously Unseen User	Anomaly	NULL		T1078.004
ESXi Account Modified	Anomaly	NULL	VMWare ESXi Syslog	T1078
ESXi External Root Login Activity	Anomaly	NULL	VMWare ESXi Syslog	T1078
ESXi Shared or Stolen Root Account	Anomaly	NULL	VMWare ESXi Syslog	T1078
ESXi User Granted Admin Role	TTP	NULL	VMWare ESXi Syslog	T1078
GCP Authentication Failed During MFA Challenge	TTP	NULL	Google Workspace login_failure	T1078.004
GCP Detect accounts with high risk roles by project	Hunting	NULL		T1078
GCP Detect gcploit framework	TTP	NULL		T1078
GCP Detect high risk permissions by resource and account	Hunting	NULL		T1078
gcp detect oauth token abuse	Hunting	NULL		T1078
GCP Multiple Failed MFA Requests For User	TTP	NULL	Google Workspace	T1078.004
GCP Successful Single-Factor Authentication	TTP	NULL	Google Workspace	T1078.004
Geographic Improbable Location	Anomaly	NULL	Okta	T1078
Identify New User Accounts	Hunting	NULL		T1078.002
Linux Usermod Root UID Set	TTP	NULL	Sysmon for Linux EventID 1	T1078
M365 Copilot Application Usage Pattern Anomalies	Anomaly	NULL	M365 Copilot Graph API	T1078
M365 Copilot Session Origin Anomalies	Anomaly	NULL	M365 Copilot Graph API	T1078
Multiple Okta Users With Invalid Credentials From The Same IP	TTP	NULL		T1078.001
O365 Multiple AppIDs and UserAgents Authentication Spike	Anomaly	NULL	O365 UserLoggedIn, O365 UserLoginFailed	T1078
O365 Security And Compliance Alert Triggered	TTP	NULL		T1078.004
Okta Account Lockout Events	Anomaly	NULL		T1078.001
Okta Authentication Failed During MFA Challenge	TTP	NULL	Okta	T1078.004
Okta Failed SSO Attempts	Anomaly	NULL		T1078.001
Okta New API Token Created	TTP	NULL	Okta	T1078.001
Okta Non-Standard VPN Usage	TTP	NULL	Okta	T1078
Okta Phishing Detection with FastPass Origin Check	TTP	NULL	Okta	T1078.001
Okta Risk Threshold Exceeded	Correlation	NULL	Okta	T1078
Okta Successful Single Factor Authentication	Anomaly	NULL	Okta	T1078.004
Okta Suspicious Activity Reported	TTP	NULL	Okta	T1078.001
Okta ThreatInsight Login Failure with High Unknown users	TTP	NULL		T1078.001
Okta ThreatInsight Suspected PasswordSpray Attack	TTP	NULL		T1078.001
Okta ThreatInsight Threat Detected	Anomaly	NULL	Okta	T1078.004
PingID Multiple Failed MFA Requests For User	TTP	NULL	PingID	T1078
Potential password in username	Hunting	NULL	Linux Secure	T1078.003
Short Lived Windows Accounts	TTP	NULL	Windows Event Log System 4720, Windows Event Log System 4726	T1078.003
Splunk User Enumeration Attempt	TTP	NULL	Splunk	T1078
Suspicious Computer Account Name Change	TTP	NULL	Windows Event Log Security 4781	T1078.002
Suspicious Kerberos Service Ticket Request	TTP	NULL	Windows Event Log Security 4769	T1078.002
Suspicious Ticket Granting Ticket Request	Hunting	NULL	Windows Event Log Security 4768, Windows Event Log Security 4781	T1078.002
Unusual Number of Computer Service Tickets Requested	Hunting	NULL	Windows Event Log Security 4769	T1078
Unusual Number of Remote Endpoint Authentication Events	Hunting	NULL	Windows Event Log Security 4624	T1078
Web Fraud - Anomalous User Clickspeed	Anomaly	NULL		T1078
Windows AD User Suspicious UPN Change	TTP	NULL	Windows Event Log Security 4738	T1078.002
Windows Azure PowerShell Module Installation Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1078
Windows Builtin Account Name Was Changed	TTP	NULL	Windows Event Log Security 4781	T1078.003
Windows ConvertTo-AADIntBackdoor Execution Via PowerShell Script	TTP	NULL	Powershell Script Block Logging 4104	T1078
Windows Entra User Management Via Azure CLI	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1078.004
Windows Group Policy Object Created	TTP	NULL	Windows Event Log Security 5136, Windows Event Log Security 5137	T1078.002
Windows Guest Account Enabled Via Net.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1078.001
Windows Large Number of Computer Service Tickets Requested	Anomaly	NULL	Windows Event Log Security 4769	T1078
Windows Multiple Account Passwords Changed	TTP	NULL	Windows Event Log Security 4724	T1078
Windows Multiple Accounts Deleted	TTP	NULL	Windows Event Log Security 4726	T1078
Windows Multiple Accounts Disabled	TTP	NULL	Windows Event Log Security 4725	T1078
Windows PowerView AD Access Control List Enumeration	TTP	NULL	Powershell Script Block Logging 4104	T1078.002
Zoom High Video Latency	Anomaly	NULL		T1078

Sub-techniques4

ID	Name	Examples
T1078.001	Default Accounts	7
T1078.002	Domain Accounts	35
T1078.003	Local Accounts	21
T1078.004	Cloud Accounts	21

Groups47

Show 23 more

Software7

Dtrack Duqu Industroyer Kinsing Linux Rabbit LP-Notes SeaDuke

Campaigns11

2015 Ukraine Electric Power Attack 3CX Supply Chain Attack Anthropic AI-orchestrated Campaign C0032 HomeLand Justice Leviathan Australian Intrusions Night Dragon Operation MidnightEclipse Operation Wocao RedPenguin SolarWinds Compromise

Procedure examples65

Groups47

Used by	Procedure example
GroupAkira	Akira uses valid account information to remotely access victim networks, such as VPN credentials. Arctic Wolf Akira 2023 Cisco Akira Ransomware OCT 2024 Secureworks GOLD SAHARA
GroupAPT18	APT18 actors leverage legitimate credentials to log into external remote services. RSA2017 Detect and Respond Adair
GroupAPT28	APT28 has used legitimate credentials to gain initial access, maintain access, and exfiltrate data from a victim network. The group has specifically used credentials stolen through a spearphishing email to login to the DCCC network. The group has also leveraged default manufacturer's passwords to gain initial access to corporate networks via IoT devices such as a VOIP phone, printer, and video decoder. Cybersecurity Advisory GRU Brute Force Campaign July 2021 DOJ GRU Indictment Jul 2018 Microsoft STRONTIUM Aug 2019 Trend Micro Pawn Storm April 2017
GroupAPT29	APT29 has used a compromised account to access an organization's VPN infrastructure. Mandiant APT29 Microsoft 365 2022
GroupAPT33	APT33 has used valid accounts for initial access and privilege escalation. FireEye APT33 Guardrail FireEye APT33 Webinar Sept 2017
GroupAPT39	APT39 has used stolen credentials to compromise Outlook Web Access (OWA). FireEye APT39 Jan 2019
GroupAPT41	APT41 used compromised credentials to log on to other systems. Crowdstrike GTR2020 Mar 2020 FireEye APT41 Aug 2019
GroupAxiom	Axiom has used previously compromised administrative accounts to escalate privileges. Novetta-Axiom

View all 47 groups examples

Software7

Used by	Procedure example
MalwareDtrack	Dtrack used hard-coded credentials to gain access to a network share. CyberBit Dtrack
MalwareDuqu	Adversaries can instruct Duqu to spread laterally by copying itself to shares it has enumerated and for which it has obtained legitimate credentials (via keylogging or other means). The remote host is then infected by using the compromised credentials to schedule a task on remote machines that executes the malware. Symantec W32.Duqu
MalwareIndustroyer	Industroyer can use supplied user credentials to execute processes and stop services. ESET Industroyer
MalwareKinsing	Kinsing has used valid SSH credentials to access remote hosts. Aqua Kinsing April 2020
MalwareLinux Rabbit	Linux Rabbit acquires valid SSH accounts through brute force. Anomali Linux Rabbit 2018
MalwareLP-Notes	LP-Notes has used stolen Windows credentials to log in as the users. ESET_MuddyWater_Dec2025
MalwareSeaDuke	Some SeaDuke samples have a module to extract email from Microsoft Exchange servers using compromised credentials. Symantec Seaduke 2015

Campaigns11

Used by	Procedure example
Campaign2015 Ukraine Electric Power Attack	During the 2015 Ukraine Electric Power Attack, Sandworm Team used valid accounts on the corporate network to escalate privileges, move laterally, and establish persistence within the corporate network. Ukraine15 - EISAC - 201603
Campaign3CX Supply Chain Attack	During 3CX Supply Chain Attack, AppleJeus has gained access to the 3CX corporate environment through legitimate VPN credentials. 3cx official statement 2023
CampaignAnthropic AI-orchestrated Campaign	During the Anthropic AI-orchestrated Campaign, the adversary used harvested credentials to authenticate against internal APIs, database systems, container registries, and logging infrastructure across targeted networks. Anthropic AI Orchestrated Campaign NOV 2025
CampaignC0032	During the C0032 campaign, TEMP.Veles used compromised VPN accounts. FireEye TRITON 2019
CampaignHomeLand Justice	During HomeLand Justice, threat actors used a compromised Exchange account to search mailboxes and create new Exchange accounts. CISA Iran Albanian Attacks September 2022
CampaignLeviathan Australian Intrusions	Leviathan used captured, valid account information to log into victim web applications and appliances during Leviathan Australian Intrusions. CISA Leviathan 2024
CampaignNight Dragon	During Night Dragon, threat actors used compromised VPN accounts to gain access to victim systems. McAfee Night Dragon
CampaignOperation MidnightEclipse	During Operation MidnightEclipse, threat actors extracted sensitive credentials while moving laterally through compromised networks. Volexity UPSTYLE 2024

View all 11 campaigns examples

References3

CISA MFA PrintNightmare Open source
Cybersecurity and Infrastructure Security Agency. (2022, March 15). Russian State-Sponsored Cyber Actors Gain Network Access by Exploiting Default Multifactor Authentication Protocols and “PrintNightmare” Vulnerability. Retrieved March 16, 2022.
TechNet Credential Theft Open source
Microsoft. (2016, April 15). Attractive Accounts for Credential Theft. Retrieved June 3, 2016.
volexity_0day_sophos_FW Open source
Adair, S., Lancaster, T., Volexity Threat Research. (2022, June 15). DriftingCloud: Zero-Day Sophos Firewall Exploitation and an Insidious Breach. Retrieved July 1, 2022.