UNC3886G1048 ↗
Has harvested and used vCenter Server service accounts.1
- Tactics
- Initial Access, Persistence, Privilege Escalation, Stealth
- Platforms
- Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- Version
- 2.0
- Created
- 13 March 2020
- Last modified
- 12 May 2026
- Contributor
- Janantha Marasinghe
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also include default factory/provider set accounts on other types of systems, software, or devices, including the root user account in AWS, the root user account in ESXi, and the default service account in Kubernetes.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
4
Threat groups70th pct
Threat groups70th percentile · 70% of ATT&CK techniques have this many threat groups attributed or fewer.1
Campaigns72nd pct
Campaigns72nd percentile · 72% of ATT&CK techniques have this many campaigns recorded or fewer.2
Tools & malware51st pct
Tools & malware51st percentile · 51% of ATT&CK techniques have this many tools implementing them or fewer.8
Detection rules71st pct
Detection rules71st percentile · 71% of ATT&CK techniques have this many detection rules written or fewer.Default Accounts MITRE reference T1078.001
70th pctamong all ATT&CK techniques for number of groups
4 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
FIN13G1016 ↗
Has leveraged default credentials for authenticating myWebMethods (WMS) and QLogic web management interface to gain initial access.1
Ember BearG1003 ↗
Has abused default user names and passwords in externally-accessible IP cameras for initial access.1
Magic HoundG0059 ↗
Enabled and used the default system managed account, DefaultAccount, via "powershell.exe" /c net user DefaultAccount /active:yes to connect to a targeted Exchange server over RDP.1
All 4 groups for this technique
1 campaign has been recorded using this technique. Listed newest first; dates are year-granularity and attribution is MITRE’s.
HomeLand JusticeC0038 ↗
During HomeLand Justice, threat actors used the built-in administrator account to move laterally using RDP and Impacket.1
All 1 campaigns for this technique
2 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
StuxnetS0603 ↗
Infected WinCC machines via a hardcoded database server password.1
HyperStackS0537 ↗
Can use default credentials to connect to IPC$ shares on remote machines.1
All 2 software entries for this technique
Offense vs defense T1078.001
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
How it got here
Range
Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.
Campaigns · 1Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 4
first rule: 2017 Q4 · 1 of 1 campaigns plottedDefault Accounts detection strategy DET0465
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Detection of Default Account Abuse Across Platforms
5 platforms
AN1283 · Windows
Detection of default account usage such as Guest or Administrator performing interactive or remote logons on systems outside of installation or maintenance windows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session CreationDC0067 | WinEventLog:Security | EventCode=4624, 4648 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| UserContext | Default usernames like 'Administrator' or 'Guest' may be renamed or disabled by the organization. Detection logic should account for name changes. |
| TimeWindow | Restrict detection to unusual hours or outside of expected maintenance windows. |
AN1284 · Linux
Monitoring for SSH logins from default accounts such as 'root', especially when login is via password and not key-based authentication.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| Logon Session MetadataDC0088 | auditd:USER_LOGIN | USER_LOGIN |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| SSHMethod | Environments using passwordless SSH should not have password logins enabled for root or other default accounts. |
| RemoteIPWhitelist | Logins from jump boxes may be whitelisted depending on environment policies. |
AN1285 · Identity Provider
Use of known default service accounts or root-level cloud accounts performing authentication or changes to IAM policy.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | AWS:CloudTrail | ConsoleLogin or AssumeRole |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccountList | Organizations may rename or rotate default IAM accounts; detection logic should be updated with any renamed or aliased default identities. |
| GeoLocation | Authentication attempts from unusual geographic regions should trigger anomaly detection. |
AN1286 · ESXi
Abuse of system-generated or default privileged accounts such as 'root' or 'vpxuser' logging into ESXi hosts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | esxi:auth | /var/log/auth.log |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| AccountName | If 'vpxuser' is replaced or configured differently, detection logic must reflect the change. |
| IPRange | Legitimate vCenter IP ranges may be whitelisted to avoid false positives. |
AN1287 · Network Devices
Login activity from default admin credentials (e.g., 'admin', 'cisco') on routers, firewalls, and switches.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account AuthenticationDC0002 | networkdevice:syslog | authentication logs |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| Username | Default usernames vary by vendor; defenders should adapt logic to their specific appliance list. |
| InterfaceType | Telnet and HTTP-based access to network devices should be blocked and monitored if enabled. |
Implement multi-factor authentication (MFA) for default accounts whenever possible to prevent unauthorized access, even if credentials for these accounts are compromised. MFA adds an additional layer of security that requires more than just a username and password, making it significantly harder for adversaries to exploit these accounts for initial access or lateral movement.
Password PoliciesM1027
Applications and appliances that utilize default username and password should be changed immediately after the installation, and before deployment to a production environment.
Tests3Executorscmd 2 · sh 1Need elevation3 of 3Have prerequisites0Have cleanup3Platformswindows, macos
Tests from Atomic Red Team (MIT licence) · technique definition