AN1283
Analytic 1283
Windows
Detection of default account usage such as Guest or Administrator performing interactive or remote logons on systems outside of installation or maintenance windows.
WinEventLog:Security
EventCode=4624, 4648
[UserContext]
Default usernames like 'Administrator' or 'Guest' may be renamed or disabled by the organization. Detection logic should account for name changes.
[TimeWindow]
Restrict detection to unusual hours or outside of expected maintenance windows.
AN1284
Analytic 1284
Linux
Monitoring for SSH logins from default accounts such as 'root', especially when login is via password and not key-based authentication.
auditd:USER_LOGIN
USER_LOGIN
[SSHMethod]
Environments using passwordless SSH should not have password logins enabled for root or other default accounts.
[RemoteIPWhitelist]
Logins from jump boxes may be whitelisted depending on environment policies.
AN1285
Analytic 1285
Identity Provider
Use of known default service accounts or root-level cloud accounts performing authentication or changes to IAM policy.
AWS:CloudTrail
ConsoleLogin or AssumeRole
[AccountList]
Organizations may rename or rotate default IAM accounts; detection logic should be updated with any renamed or aliased default identities.
[GeoLocation]
Authentication attempts from unusual geographic regions should trigger anomaly detection.
AN1286
Analytic 1286
ESXi
Abuse of system-generated or default privileged accounts such as 'root' or 'vpxuser' logging into ESXi hosts.
esxi:auth
/var/log/auth.log
[AccountName]
If 'vpxuser' is replaced or configured differently, detection logic must reflect the change.
[IPRange]
Legitimate vCenter IP ranges may be whitelisted to avoid false positives.
AN1287
Analytic 1287
Network Devices
Login activity from default admin credentials (e.g., 'admin', 'cisco') on routers, firewalls, and switches.
networkdevice:syslog
authentication logs
[Username]
Default usernames vary by vendor; defenders should adapt logic to their specific appliance list.
[InterfaceType]
Telnet and HTTP-based access to network devices should be blocked and monitored if enabled.