Default Accounts (T1078.001) is a sub-technique of Valid Accounts. It maps to stealth, persistence, privilege escalation and initial access, and applies to Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS and Windows.
How attackers use it
MITRE defines default accounts as those built into an operating system, such as Guest or Administrator on Windows. They also include factory or provider set accounts on other systems, software and devices. MITRE's examples are the root user account in AWS, the root user in ESXi, and the default service account in Kubernetes.
The accounts are not limited to client machines. Network devices and applications, whether internal, open source or commercial, may ship with a preset username and password. MITRE says appliances that keep that combination after installation are easy targets. Adversaries may also use publicly disclosed or stolen private keys or credential material to connect through remote services.
Default accounts can also appear after setup. MITRE's example: when an ESXi server is connected to a vCenter server, a privileged account called vpxuser is created on the ESXi server. If an adversary compromises that account's credentials, for example by exploiting the vCenter host, they gain access to ESXi.
How to detect it
MITRE's strategy (DET0465) lists these patterns:
- Windows: Guest or Administrator performing interactive or remote logons outside installation or maintenance windows.
- Linux: SSH logins as root, especially with a password rather than a key.
- Cloud: known default service accounts or root level cloud accounts authenticating or changing IAM policy.
- ESXi: root or vpxuser logging into ESXi hosts.
- Network devices: logins with default admin credentials such as admin or cisco on routers, firewalls and switches.
Because legitimate use of these accounts should be rare, even simple alerts have a low false positive rate.
How to reduce the risk
MITRE lists two mitigations:
- Change default usernames and passwords immediately after installation and before the system goes to production (Password Policies).
- Use multi-factor authentication for default accounts whenever possible (Multi-factor Authentication).
Check your own environment
- Do you have an inventory of devices and appliances, and is each one confirmed to have non-factory credentials?
- Is the AWS root user protected with MFA, and when was it last used?
- Is root SSH login by password disabled on your Linux hosts?
On Linux, one read-only way to check the SSH setting:
sshd -T | grep -i permitrootlogin
You may need to run this with elevated rights to read the effective configuration.
Quick check
Name a default account MITRE says is created after setup rather than at install.
The vpxuser account, created on an ESXi server when it is connected to a vCenter server.
Sources
- MITRE ATT&CK, T1078.001 Default Accounts: https://attack.mitre.org/techniques/T1078/001/
