t1078-001-default-accounts

name	T1078.001_default-accounts
description	Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1078.001","defense-evasion","persistence","privilege-escalation","initial-access","windows","saas","iaas","linux","macos","containers","network-devices","office-suite","identity-provider","esxi","sub-technique"]
technique_id	T1078.001
tactic	defense-evasion
all_tactics	["defense-evasion","persistence","privilege-escalation","initial-access"]
platforms	["Windows","SaaS","IaaS","Linux","macOS","Containers","Network Devices","Office Suite","Identity Provider","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1078/001
tech_stack	["windows","saas","cloud","linux","macos","containers","network devices","office","identity","esxi"]
cwe_ids	["CWE-693"]
chains_with	["T1078","T1078.002","T1078.003","T1078.004"]
prerequisites	["T1078"]
severity_boost	{"T1078":"Chain with T1078 for deeper attack path","T1078.002":"Chain with T1078.002 for deeper attack path","T1078.003":"Chain with T1078.003 for deeper attack path"}

T1078.001 Default Accounts

Sub-technique of: T1078

High-Level Description

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.

Default accounts are not limited to client machines; rather, they also include accounts that are preset for equipment such as network devices and computer applications, whether they are internal, open source, or commercial. Appliances that come preset with a username and password combination pose a serious threat to organizations that do not change it post installation, as they are easy targets for an adversary. Similarly, adversaries may also utilize publicly disclosed or stolen Private Keys or credential materials to legitimately connect to remote environments via Remote Services.

Default accounts may be created on a system after initial setup by connecting or integrating it with another application. For example, when an ESXi server is connected to a vCenter server, a default privileged account called vpxuser is created on the ESXi server. If a threat actor is able to compromise this account’s credentials (for example, via Exploitation for Credential Access on the vCenter host), they will then have access to the ESXi server.

Kill Chain Phase

• Defense Evasion (TA0005)
• Persistence (TA0003)
• Privilege Escalation (TA0004)
• Initial Access (TA0001)

Platforms: Windows, SaaS, IaaS, Linux, macOS, Containers, Network Devices, Office Suite, Identity Provider, ESXi

What to Check

• Identify if Default Accounts technique is applicable to target environment
• Check Windows systems for indicators of Default Accounts
• Check SaaS systems for indicators of Default Accounts
• Check IaaS systems for indicators of Default Accounts
• Verify mitigations are bypassed or absent (2 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test