T1078.001 — Default Accounts

Tactics: Stealth, Persistence, Privilege Escalation, Initial Access · Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those that are built-into an OS, such as the Guest or Administrator accounts on Windows systems. Default accounts also…

Sub-technique of Valid Accounts (T1078).

Sigma detection rules (5)

title: "T1078.001 Valid Accounts: Default Accounts"
id: 6bcad60f-b548-4c2e-a799-a6b0c2b49a2b
description: 'Detection of Default Account Abuse Across Platforms. (Data Component: Logon Session Creation; baseline tier: windows-eventid.) Tune using: UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1078/001
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.001

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - '4624'
      - '4648'

  selection_default_account:
    TargetUserName:
      - 'Administrator'
      - 'Guest'
      - 'DefaultAccount'
      - 'WDAGUtilityAccount'
      - 'root'
      - 'admin'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and selection_default_account and not filter_system_account

falsepositives:
  - Break-glass or emergency use of built-in Administrator/Guest accounts by authorized IT staff during outages; tune UserContext allowlists for approved break-glass procedures.

level: medium

title: "T1078.001 Valid Accounts: Default Accounts"
id: de9e39c3-8534-411e-96cb-3113d6bae6a1
description: 'Detection of Default Account Abuse Across Platforms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: SSHMethod, RemoteIPWhitelist.'
references:
  - https://attack.mitre.org/techniques/T1078/001
author: Shahrukh Khan
date: 2026-02-02
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.001

logsource:
  product: linux
  service: auditd

detection:
  selection:
    type: USER_LOGIN
    res: success
  selection_default:
    type: USER_LOGIN
    acct|contains:
      - 'root'
      - 'admin'
      - 'ubuntu'
      - 'pi'
      - 'ec2-user'

  condition: selection and selection_default

falsepositives:
  - Cloud image default accounts (ubuntu, ec2-user) are used legitimately by provisioning tooling on first boot; scope to logins occurring well after the expected first-boot bootstrap window.

level: high

title: "T1078.001 Valid Accounts: Default Accounts"
id: 905435c0-db65-48e7-a7d5-5fe275dd005d
description: 'Detection of Default Account Abuse Across Platforms. (Retargeted to the cloudtrail AWS telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccountList, GeoLocation.'
references:
  - https://attack.mitre.org/techniques/T1078/001
author: Shahrukh Khan
date: 2026-05-05
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.001

logsource:
  category: cloudtrail
  product: aws

detection:
  selection:
    eventName: 'ConsoleLogin'
    userIdentity.type: 'Root'
    responseElements.ConsoleLogin: 'Success'
  filter_mfa:
    additionalEventData.MFAUsed: 'Yes'

  condition: selection and not filter_mfa

falsepositives:
  - Root logins should be exceedingly rare in a well-governed account, so any match without MFA warrants immediate investigation and false positives are limited to break-glass emergency access procedures.

level: critical

title: "T1078.001 Valid Accounts: Default Accounts"
id: 3d474c7e-16e8-4a40-a964-49238c9deb1e
description: 'Detection of Default Account Abuse Across Platforms. (Data Component: User Account Authentication; baseline tier: fallback.) Tune using: Username, InterfaceType.'
references:
  - https://attack.mitre.org/techniques/T1078/001
author: Shahrukh Khan
date: 2026-04-11
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.001

logsource:
  product: networkdevice
  service: syslog

detection:
  selection_default_user:
    Message|contains:
      - 'Login Success'
      - 'Authentication OK'
  selection_default_account:
    Message|contains:
      - 'admin'
      - 'cisco'
  condition: selection_default_user and selection_default_account

falsepositives:
  - An intentionally retained default account used temporarily during initial device staging before hardening will also match.

level: high

title: "T1078.001 Valid Accounts: Default Accounts"
id: 853a2838-a937-4db2-8429-caf6a5d0b20c
description: 'Detection of Default Account Abuse Across Platforms. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: AccountName, IPRange.'
references:
  - https://attack.mitre.org/techniques/T1078/001
author: Shahrukh Khan
date: 2026-04-07
license: MIT
tags:
  - attack.stealth
  - attack.persistence
  - attack.privilege-escalation
  - attack.initial-access
  - attack.t1078.001

logsource:
  product: esxi
  service: auth

detection:
  selection:
    Message|contains: 'root'
  selection_login:
    Message|contains: 'Accepted password'

  condition: selection and selection_login

falsepositives:
  - Legitimate administrative use of the built-in root account for emergency access when Active Directory authentication is unavailable will also match; source IP text parsing in auth.log is inconsistent across ESXi versions so IP-based allowlisting is only partially reliable.

level: high

Related sub-techniques

• T1078.004 Cloud Accounts
• T1078.003 Local Accounts
• T1078.002 Domain Accounts

Explore

• All Sigma rules for MITRE ATT&CK
• Sigma rule format guide
• Full T1078.001 intelligence — ATT&CK Intelligence View
• Official MITRE ATT&CK entry
• Built by Shahrukh Khan