Privilege Abuse (Insider)
0 confirmed incidents.
VERIS: misuse:Privilege abuseMITRE ATT&CK: T1078 (Valid Accounts)T1087 (Account Discovery)
MITRE ATT&CK technique names and ids on this page are reproduced and distributed with the permission of The MITRE Corporation. © 2015–2026, The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation.
Privilege abuse (insider) covers an incident caused by someone who already had legitimate access to a system using that access beyond what their role required or permitted, rather than by an external attacker breaking in. It maps to two MITRE ATT&CK techniques: T1078 (Valid Accounts), using a real, authorized login rather than a stolen one, and T1087 (Account Discovery), identifying which other accounts or systems exist and are reachable from the insider's own position. Because the access itself is legitimate, an incident classified this way is usually detected through unusual access patterns rather than a technical intrusion signature.
No confirmed incidents currently carry this attack-type classification.
Questions and answers
How many confirmed incidents are classified as Privilege Abuse (Insider) on Breach Census?
0 confirmed incidents are currently classified as Privilege Abuse (Insider).
Which MITRE ATT&CK techniques does the Privilege Abuse (Insider) classification cover?
This classification maps to MITRE ATT&CK techniques T1078 (Valid Accounts), T1087 (Account Discovery).
What counts as a confirmed incident for the Privilege Abuse (Insider) classification?
An incident counts here once it carries the Privilege Abuse (Insider) attack-type classification and has reached the confirmed status described on the Methodology page; a bare claim or press report is not enough.