Default Accounts

Default accounts represent a critical vulnerability within the "Gain Access" phase, specifically under the "Valid Accounts" technique. These are pre-configured user accounts established by system vendors or developers with predefined credentials that are often well-documented in manuals or widely known across the internet. Adversaries actively target these accounts because they frequently remain unchanged in production environments due to oversight, insufficient security policies, or inadequate implementation of security controls. By leveraging default accounts in critical systems like network devices, databases, web applications, or IoT devices, attackers can establish initial access with legitimate credentials that may possess elevated privileges. This eliminates the need for exploitation of technical vulnerabilities and significantly reduces the likelihood of detection since the activity appears as legitimate authentication. The compromise of default accounts is particularly dangerous when these accounts possess administrative privileges, potentially allowing attackers to immediately move laterally, escalate privileges, or deploy persistence mechanisms deeper within the network.