TA0001 · INITIAL ACCESS
Default Accounts
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion.
Detect it with
Monitor whether default accounts have been activated or logged into. These audits should also include checks on any appliances and applications for default credentials or SSH keys, and if any are discovered, they should be updated immediately.
Why it matters on shift
Default Accounts is one of the concrete ways adversaries achieve initial access. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After initial access, the next tactic is usually Execution. Search your telemetry for the transition before closing the ticket.
Kill-chain context