Detect Default Accounts in Microsoft Sentinel
Adversaries may obtain and abuse credentials of a default account as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Default accounts are those built into an OS (e.g., Guest or Administrator on Windows, root on Linux), preset on network devices/appliances, or created automatically by software integrations (e.g., vpxuser on ESXi when joined to vCenter). Adversaries exploit organizations that fail to disable, rename, or change the passwords of these accounts post-installation.
MITRE ATT&CK
- Technique
- T1078 Valid Accounts
- Sub-technique
- T1078.001 Default Accounts
- Canonical reference
- https://attack.mitre.org/techniques/T1078/001/
KQL Detection Query
let DefaultAccountNames = dynamic([
"administrator", "guest", "defaultaccount", "defaultuser", "admin",
"root", "vpxuser", "dcadmin", "sysadmin", "service", "support",
"user", "test", "demo", "operator", "sa", "netadmin"
]);
let SuspiciousLogonTypes = dynamic([2, 3, 7, 10]);
// Part 1: Windows Security Logon Events for default account usage
let WindowsLogons = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4624, 4625, 4648)
| where tolower(TargetUserName) in (DefaultAccountNames)
| extend LogonTypeName = case(
LogonType == 2, "Interactive",
LogonType == 3, "Network",
LogonType == 7, "Unlock",
LogonType == 10, "RemoteInteractive",
LogonType == 4, "Batch",
LogonType == 5, "Service",
tostring(LogonType)
)
| extend IsFailedLogon = (EventID == 4625)
| extend IsExplicitCred = (EventID == 4648)
| project
TimeGenerated,
Computer,
EventID,
TargetUserName,
TargetDomainName,
LogonType,
LogonTypeName,
IpAddress,
WorkstationName,
IsFailedLogon,
IsExplicitCred,
SubjectUserName,
SubjectDomainName
| extend AlertSource = "WindowsSecurityLogon";
// Part 2: Defender for Endpoint DeviceLogonEvents
let MdeLogons = DeviceLogonEvents
| where Timestamp > ago(24h)
| where tolower(AccountName) in (DefaultAccountNames)
| extend IsFailedLogon = (ActionType == "LogonFailed")
| project
TimeGenerated = Timestamp,
Computer = DeviceName,
EventID = 0,
TargetUserName = AccountName,
TargetDomainName = AccountDomain,
LogonType,
LogonTypeName = LogonType,
IpAddress = RemoteIP,
WorkstationName = RemoteDeviceName,
IsFailedLogon,
IsExplicitCred = false,
SubjectUserName = InitiatingProcessAccountName,
SubjectDomainName = InitiatingProcessAccountDomain
| extend AlertSource = "MDE";
// Part 3: Command-line evidence of default account manipulation
let DefaultAccountCmdline = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (
"net user defaultaccount /active:yes",
"net user guest /active:yes",
"net user administrator /active:yes",
"DefaultAccount",
"net localgroup administrators guest",
"net localgroup administrators defaultaccount"
)
| project
TimeGenerated = Timestamp,
Computer = DeviceName,
EventID = 0,
TargetUserName = AccountName,
TargetDomainName = AccountDomain,
LogonType = 0,
LogonTypeName = "ProcessExecution",
IpAddress = "",
WorkstationName = "",
IsFailedLogon = false,
IsExplicitCred = false,
SubjectUserName = InitiatingProcessAccountName,
SubjectDomainName = InitiatingProcessAccountDomain
| extend AlertSource = "CmdlineActivity";
WindowsLogons
| union MdeLogons
| union DefaultAccountCmdline
| sort by TimeGenerated descDetects usage of default built-in accounts (Administrator, Guest, DefaultAccount, root, vpxuser, etc.) via Windows Security logon events (4624/4625/4648), Microsoft Defender for Endpoint DeviceLogonEvents, and command-line evidence of default account activation (e.g., net user DefaultAccount /active:yes). Covers interactive, network, and remote interactive logon types. Flags both successful and failed logon attempts as well as explicit credential use.
Data Sources
Required Tables
False Positives & Tuning
- Legitimate administrator accounts named 'Administrator' used by IT staff for maintenance tasks in environments without privileged access workstations (PAWs)
- Automated deployment or imaging systems that authenticate with the built-in Administrator account during machine provisioning (SCCM OSD, MDT)
- Legacy applications or services running under the built-in Guest or Administrator context that have not been migrated to service accounts
- Penetration testing or red team exercises explicitly testing default credential scenarios
- Database administrators legitimately connecting via 'sa' account to SQL Server instances in older environments
Other platforms for T1078.001
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Enable and Use Built-in DefaultAccount via PowerShell (Magic Hound TTP)
Expected signal: Sysmon Event ID 1: Process Create with CommandLine containing 'net user DefaultAccount /active:yes'. Windows Security Event ID 4722 (User Account Enabled) with TargetUserName=DefaultAccount. Windows Security Event ID 4725 (User Account Disabled) after cleanup. Security Event ID 4688 (process creation) if command-line auditing is enabled.
- Test 2Enable Built-in Guest Account and Verify Access
Expected signal: Windows Security Event ID 4722 (User Account Enabled) with TargetUserName=Guest. Windows Security Event ID 4688 or Sysmon Event ID 1 with CommandLine 'net user Guest /active:yes'. Security Event ID 4625 if subsequent logon attempt is made. Event ID 4725 on cleanup.
- Test 3Authenticate Using Built-in Administrator Account via Net Use (HyperStack-style IPC$ Access)
Expected signal: Windows Security Event ID 4648 (Logon using explicit credentials) with TargetUserName=Administrator and TargetServerName=127.0.0.1. Windows Security Event ID 4624 (logon type 3 - Network) or 4625 (failed logon) on the target host. Sysmon Event ID 1 with CommandLine 'net use \\127.0.0.1\IPC$'. Sysmon Event ID 3 (network connection) to port 445.
- Test 4Simulate Default Service Account Logon via Scheduled Task
Expected signal: Windows Security Event ID 4698 (Scheduled Task Created) with task name 'DefaultAccountTest'. Windows Security Event ID 4624 (SYSTEM logon type 5) when task executes. Sysmon Event ID 1 for schtasks.exe and cmd.exe processes. Sysmon Event ID 11 (File Created) for the output file in TEMP. Security Event ID 4699 (Scheduled Task Deleted) on cleanup.
References (14)
- https://attack.mitre.org/techniques/T1078/001/
- https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
- https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html
- https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/
- https://pentera.io/blog/information-disclosure-in-vmware-vcenter/
- https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/
- https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh
- https://www.cisa.gov/news-events/cybersecurity-advisories/aa24-249a
- https://www.sygnia.co/blog/elephant-beetle-an-organized-financial-threat/
- https://thedfirreport.com/2021/11/15/exchange-exploit-leads-to-domain-wide-ransomware/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.001/T1078.001.md
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4624
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4625
- https://learn.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4722
Unlock Pro Content
Get the full detection package for T1078.001 including response playbook, investigation guide, and atomic red team tests.