Valid Accounts
Valid Accounts are like a thief using a stolen key to enter a house. Instead of breaking a window, the attacker uses real usernames, passwords, or digital keys to log into AI systems as if they were a legitimate user.
Valid Accounts refers to the technique where adversaries gain unauthorized access to AI environments by using legitimate credentials, such as compromised user passwords or leaked API keys. Once inside, they can bypass standard authentication to access AI models, datasets, or development pipelines.
Valid Accounts is an Initial Access technique where adversaries obtain and abuse credentials of existing accounts—including individual user credentials or API keys—to authenticate to AI resources and services. This access facilitates unauthorized interaction with AI artifacts, enables the execution of discovery techniques like AML.T0007, and may provide escalated privileges for the modification of AI models or production infrastructure.