Default Accounts
Subtechnique · ATTACK:enterprise:T1078.001
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1078.001",
"title": "Default Accounts",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1078/001",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--6151cbea-819b-455a-9fa6-99a1cc58797d",
"external_id": "T1078.001",
"domain": "enterprise",
"created": "2020-03-13T20:15:31.974Z",
"modified": "2026-05-12T15:12:00.636Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth",
"persistence",
"privilege-escalation",
"initial-access"
],
"source_references": [
{
"source_name": "Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023",
"url": "https://cloud.google.com/blog/topics/threat-intelligence/vmware-esxi-zero-day-bypass/"
},
{
"source_name": "AWS Root User",
"url": "https://docs.aws.amazon.com/IAM/latest/UserGuide/id_root-user.html"
},
{
"source_name": "Microsoft Local Accounts Feb 2019",
"url": "https://docs.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts"
},
{
"source_name": "Metasploit SSH Module",
"url": "https://github.com/rapid7/metasploit-framework/tree/master/modules/exploits/linux/ssh"
},
{
"source_name": "Threat Matrix for Kubernetes",
"url": "https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/"
},
{
"source_name": "Pentera vCenter Information Disclosure",
"url": "https://pentera.io/blog/information-disclosure-in-vmware-vcenter/"
}
]
}Explicit source assertions (10)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G1016 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0afa86ee-1253-4f15-87a8-abb46422313b
Sygnia Elephant Beetle Jan 2022ATTACK:enterprise:G1048 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--0d122084-f2fa-4247-a913-068a3250c89b
Google Cloud Threat Intelligence VMWare ESXi Zero-Day 2023ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3e2212a9-9347-46ac-ae96-04e558973779
ATTACK:enterprise:S0537 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--3f23a228-4817-44a0-9d08-210c23057b42
Accenture HyperStack October 2020ATTACK:enterprise:C0038 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--47e6ea9a-cb80-49ba-8a72-bad2eafa7cd8
Microsoft Albanian Government Attacks September 2022ATTACK:enterprise:G0059 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--815e257d-f4bf-4124-8063-634d6710d66f
DFIR Phosphorus November 2021ATTACK:enterprise:M1027 → mitigates → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--884964fd-ae2b-4a3f-a023-98e79b967943
US-CERT Alert TA13-175A Risks of Default Passwords on the InternetATTACK:enterprise:S0603 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--9c8be5c7-5f72-4c60-aaf7-f1f62eaf91f2
Nicolas Falliere, Liam O Murchu, Eric Chien February 2011ATTACK:enterprise:T1078.001 → subtechnique-of → ATTACK:enterprise:T1078
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--cb3b9d54-ba89-4af4-8724-3ffde36d101c
ATTACK:enterprise:G1003 → uses → ATTACK:enterprise:T1078.001
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--fa38f089-4ab6-464b-aab6-df2a0f0bdc6e
CISA GRU29155 2024