1200KM / detection
T1078.001 Default Accounts — Detection Rules
Detection workspace for T1078.001 Default Accounts: 3 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Root Account Enable Via Dsenableroot · test · medium · {"category":"process_creation","product":"macos"}
- Guest Account Enabled Via Sysadminctl · test · low · {"category":"process_creation","product":"macos"}
- Admin User Remote Logon · test · low · {"product":"windows","service":"security","definition":"Requirements: Identifiable administrators usernames (pattern or special unique character. ex: \"Admin-*\"), internal policy mandating use only as secondary account"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0465 Detection of Default Account Abuse Across Platforms
AN1283 Analytic 1283
Detection of default account usage such as Guest or Administrator performing interactive or remote logons on systems outside of installation or maintenance windows.
AN1284 Analytic 1284
Monitoring for SSH logins from default accounts such as 'root', especially when login is via password and not key-based authentication.
AN1285 Analytic 1285
Use of known default service accounts or root-level cloud accounts performing authentication or changes to IAM policy.
AN1286 Analytic 1286
Abuse of system-generated or default privileged accounts such as 'root' or 'vpxuser' logging into ESXi hosts.
AN1287 Analytic 1287
Login activity from default admin credentials (e.g., 'admin', 'cisco') on routers, firewalls, and switches.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1078.001 simulation workspace
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.