{"id":"T1078.001","name":"Default Accounts","url":"https://attack.mitre.org/techniques/T1078/001","tactics":["stealth","persistence","privilege-escalation","initial-access"],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0465","stix_id":"x-mitre-detection-strategy--cff5ca37-cc4a-431c-b481-d0ccabbf6980","name":"Detection of Default Account Abuse Across Platforms","url":"https://attack.mitre.org/detectionstrategies/DET0465","analytics":[{"id":"AN1283","stix_id":"x-mitre-analytic--7a3dd710-39a7-4327-8d3b-150c50b2c680","name":"Analytic 1283","description":"Detection of default account usage such as Guest or Administrator performing interactive or remote logons on systems outside of installation or maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0465#AN1283","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4624, 4648","data_component":"DC0067","data_component_name":"Logon Session Creation","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"UserContext","description":"Default usernames like 'Administrator' or 'Guest' may be renamed or disabled by the organization. Detection logic should account for name changes."},{"field":"TimeWindow","description":"Restrict detection to unusual hours or outside of expected maintenance windows."}],"live":true,"detection_strategies":["DET0465"],"techniques":["T1078.001"]},{"id":"AN1284","stix_id":"x-mitre-analytic--c804a181-f0be-41dd-81ce-95e0a3e5245d","name":"Analytic 1284","description":"Monitoring for SSH logins from default accounts such as 'root', especially when login is via password and not key-based authentication.","url":"https://attack.mitre.org/detectionstrategies/DET0465#AN1284","platforms":["Linux"],"log_source_references":[{"name":"auditd:USER_LOGIN","channel":"USER_LOGIN","data_component":"DC0088","data_component_name":"Logon Session Metadata","log_source_slug":"auditd-user-login"}],"mutable_elements":[{"field":"SSHMethod","description":"Environments using passwordless SSH should not have password logins enabled for root or other default accounts."},{"field":"RemoteIPWhitelist","description":"Logins from jump boxes may be whitelisted depending on environment policies."}],"live":true,"detection_strategies":["DET0465"],"techniques":["T1078.001"]},{"id":"AN1285","stix_id":"x-mitre-analytic--a8ed4e86-c79a-40db-84e5-1b4cf0e917d3","name":"Analytic 1285","description":"Use of known default service accounts or root-level cloud accounts performing authentication or changes to IAM policy.","url":"https://attack.mitre.org/detectionstrategies/DET0465#AN1285","platforms":["Identity Provider"],"log_source_references":[{"name":"AWS:CloudTrail","channel":"ConsoleLogin or AssumeRole","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"aws-cloudtrail"}],"mutable_elements":[{"field":"AccountList","description":"Organizations may rename or rotate default IAM accounts; detection logic should be updated with any renamed or aliased default identities."},{"field":"GeoLocation","description":"Authentication attempts from unusual geographic regions should trigger anomaly detection."}],"live":true,"detection_strategies":["DET0465"],"techniques":["T1078.001"]},{"id":"AN1286","stix_id":"x-mitre-analytic--96fe3582-b1a3-40e4-9e9d-bab764f2af7e","name":"Analytic 1286","description":"Abuse of system-generated or default privileged accounts such as 'root' or 'vpxuser' logging into ESXi hosts.","url":"https://attack.mitre.org/detectionstrategies/DET0465#AN1286","platforms":["ESXi"],"log_source_references":[{"name":"esxi:auth","channel":"/var/log/auth.log","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"esxi-auth"}],"mutable_elements":[{"field":"AccountName","description":"If 'vpxuser' is replaced or configured differently, detection logic must reflect the change."},{"field":"IPRange","description":"Legitimate vCenter IP ranges may be whitelisted to avoid false positives."}],"live":true,"detection_strategies":["DET0465"],"techniques":["T1078.001"]},{"id":"AN1287","stix_id":"x-mitre-analytic--305b6a70-6d5b-4b32-a40b-ae0cae342e62","name":"Analytic 1287","description":"Login activity from default admin credentials (e.g., 'admin', 'cisco') on routers, firewalls, and switches.","url":"https://attack.mitre.org/detectionstrategies/DET0465#AN1287","platforms":["Network Devices"],"log_source_references":[{"name":"networkdevice:syslog","channel":"authentication logs","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"networkdevice-syslog"}],"mutable_elements":[{"field":"Username","description":"Default usernames vary by vendor; defenders should adapt logic to their specific appliance list."},{"field":"InterfaceType","description":"Telnet and HTTP-based access to network devices should be blocked and monitored if enabled."}],"live":true,"detection_strategies":["DET0465"],"techniques":["T1078.001"]}],"live":true,"version":"1.0","techniques":["T1078.001"]}],"sigma_rules":[{"id":"0f63e1ef-1eb9-4226-9d54-8927ca08520a","title":"Admin User Remote Logon","author":"juju4","status":"test","level":"low","date":"2017-10-29","modified":"2022-10-09","description":"Detect remote login by Administrator user (depending on internal pattern).","references":["https://car.mitre.org/wiki/CAR-2016-04-005"],"logsource":{"product":"windows","service":"security"},"tags":["attack.privilege-escalation","attack.persistence","attack.lateral-movement","attack.initial-access","attack.stealth","attack.t1078.001","attack.t1078.002","attack.t1078.003","car.2016-04-005"],"path":"rules/windows/builtin/security/account_management/win_security_admin_rdp_login.yml","techniques":["T1078.001","T1078.002","T1078.003"],"cves":[]},{"id":"821bcf4d-46c7-4b87-bc57-9509d3ba7c11","title":"Root Account Enable Via Dsenableroot","author":"Sohan G (D4rkCiph3r)","status":"test","level":"medium","date":"2023-08-22","modified":null,"description":"Detects attempts to enable the root account via \"dsenableroot\"","references":["https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md","https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml","https://ss64.com/osx/dsenableroot.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.privilege-escalation","attack.stealth","attack.t1078","attack.t1078.001","attack.t1078.003","attack.initial-access","attack.persistence"],"path":"rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml","techniques":["T1078","T1078.001","T1078.003"],"cves":[]},{"id":"917789e1-2c1f-4bf5-8c91-6f71a017f469","title":"Commvault QLogin with PublicSharingUser and GUID Password (CVE-2025-57788)","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","status":"experimental","level":"medium","date":"2025-10-20","modified":null,"description":"Detects a qlogin.exe command attempting to authenticate as the internal `_+_PublicSharingUser_` using a GUID as the password.\nThis could be an indicator of an attacker exploiting CVE-2025-57788 to gain initial access using leaked credentials.\n","references":["https://labs.watchtowr.com/guess-who-would-be-stupid-enough-to-rob-the-same-vault-twice-pre-auth-rce-chains-in-commvault/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078.001","detection.emerging-threats","cve.2025-57788"],"path":"rules-emerging-threats/2025/Exploits/CVE-2025-57788/proc_creation_win_exploit_cve_2025_57788.yml","techniques":["T1078.001"],"cves":["CVE-2025-57788"]},{"id":"d7329412-13bd-44ba-a072-3387f804a106","title":"Guest Account Enabled Via Sysadminctl","author":"Sohan G (D4rkCiph3r)","status":"test","level":"low","date":"2023-02-18","modified":null,"description":"Detects attempts to enable the guest account using the sysadminctl utility","references":["https://ss64.com/osx/sysadminctl.html"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.privilege-escalation","attack.persistence","attack.initial-access","attack.stealth","attack.t1078","attack.t1078.001"],"path":"rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml","techniques":["T1078","T1078.001"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}