Recent Use of the Default Administrator Account

medium

Language:

Description

Except in very rare specific cases, avoid using built-in administrative accounts.

Solution

Administrators should use a nominative and dedicated administrative account to perform daily administrative tasks.

See Also

Securing Active Directory Administrative Groups and Accounts

Appendix D: Securing Built-In Administrator Accounts in Active Directory

Indicator Details

Name: Recent Use of the Default Administrator Account

Codename: C-ADM-ACC-USAGE

Severity: Medium

Type: Active Directory Indicator of Exposure

MITRE ATT&CK Information:

Tactic: TA0006 - Credential Access
- Techniques: T1003 - OS Credential Dumping
Tactic: TA0005 - Defense Evasion
- Techniques: T1078 - Valid Accounts
Tactic: TA0004 - Privilege Escalation
- Techniques: T1078 - Valid Accounts