T1078.001sub-technique of T1078 Valid Accounts
Default Accounts
Containers · ESXi · IaaS · Identity Provider · Linux · macOS · Network Devices · Office Suite · SaaS · Windows1 piece on this siteT1078.001 on attack.mitre.org
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems.
If this is happening now
Checklists and playbooks to open while the alert is still live.
Edge appliance or VPN compromise
A vendor advisory for a device you run at the perimeter, unexplained admin sessions on it, or an internal alert whose earliest source is the VPN range.
Web shell on a public-facing server
An unfamiliar file in a web root, a web server process spawning a shell, or outbound traffic from a machine that should only ever receive it.
Suspicious execution on an endpoint
An EDR alert, an unexplained process, or a user reporting something odd.
Cloud account compromise
Impossible travel, an unrecognised inbox rule, or a reported invoice-fraud attempt.
Read
Analyses, case studies, guides, references and interview questions.
Evidence Gap Challenge No. 3: four people knew that password
An operational technology jump host, a shared engineering account, and a change nobody will own. Every log works, every timestamp is right, and attribution is still impossible. Work out what that costs, and what you would have needed to collect to make a name provable.
how MITRE says to see it
Detection of Default Account Abuse Across Platforms
- Detection of default account usage such as Guest or Administrator performing interactive or remote logons on systems outside of installation or maintenance windows.
- Monitoring for SSH logins from default accounts such as 'root', especially when login is via password and not key-based authentication.
- Use of known default service accounts or root-level cloud accounts performing authentication or changes to IAM policy.
- Abuse of system-generated or default privileged accounts such as 'root' or 'vpxuser' logging into ESXi hosts.
what reduces it
- M1027 Password Policies. Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.
- M1032 Multi-factor Authentication. Implement multi-factor authentication (MFA) for default accounts whenever possible to prevent unauthorized access, even if credentials for these accounts are compromised. MFA adds an additional layer of security that requires more than just a username and password, making it significantly harder for adversaries to exploit these accounts for initial access or lateral movement.