Threadlinqs IntelligenceStart free

ATT&CK techniqueInitial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)

T1078.001 Default Accounts

Initial AccessPersistencePrivilege EscalationStealth (formerly Defense Evasion)EnterpriseSub-technique

As of 2026-10-05, T1078.001 (Default Accounts) appears in 32 tracked threats, first reported 2026-02-02 and most recently 2026-10-02, with linked actors including Sandworm, Static Tundra, APT44; it most often appears alongside T1190 (Exploit Public-Facing Application).

Tracked threats
3223 critical, 6 high, 3 medium
First seen
2026-02-02
Last seen
2026-10-02
Threat actors
15In the threats using it
Detection rules
122Blue tier and above

Data as of:

Activity timeline

T1078.001 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 13 reports, and 32 of the 32 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1078.001 Default Accounts is catalogued by MITRE ATT&CK under the Initial Access and Persistence and Privilege Escalation and Stealth (formerly Defense Evasion) tactics in the Enterprise matrix, as a sub-technique of T1078 Valid Accounts. Threadlinqs maps 32 of 2623 tracked threats (1.2%) to it; by severity that is 23 critical, 6 high, 3 medium.

Threats that use T1078.001 most often also use T1190 Exploit Public-Facing Application (27 threats), T1046 Network Service Discovery (23 threats), T1068 Exploitation for Privilege Escalation (16 threats), T1082 System Information Discovery (16 threats), T1059 Command and Scripting Interpreter (15 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

15 tracked threat actors appear in the threats that use T1078.001; the most frequent are Sandworm (3), Static Tundra (3), APT44 (2), FSB Center 16 (2), JADEPUFFER (2).

Mitigations

MITRE ATT&CK lists 2 mitigations for T1078.001.

Data sources

Telemetry that can reveal T1078.001, per MITRE ATT&CK.

  • Logon Session — Logon Session Creation
  • User Account — User Account Authentication

Threat actors using it

Tracked threats

The 30 most recent of 32 tracked threats that use T1078.001.

Detection coverage

Threadlinqs maintains 122 detection rules mapped to T1078.001 (SPL 45, KQL 46, Sigma 31). Rule content is available to Blue tier accounts and above; this page shows counts only.

122 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Parent technique

T1078 Valid Accounts — 718 tracked threats at the technique level.