Valid Accounts

Why this is removed

Valid Accounts fails the criteria for a technique. It defines no event — it describes a resource (valid credentials) that an attacker possesses, not an action that occurs on a system. Attackers cannot choose to avoid it — any use of a victim system involves valid accounts by definition. No ontological definition is possible because there is no artifact modification to describe, which means no detection rule can be written against the technique itself. Teams currently use it as a whitelist bucket, which underlines its dissimilarity from the rest of the framework. The access type (compromised credential, default credential, etc.) should be modelled as a precondition on the techniques that follow.