| ID | Name |
|---|---|
| T1694.001 | Default Credentials |
| T1694.002 | Hardcoded Credentials |
Adversaries may leverage manufacturer or supplier set default credentials on control system devices. These default credentials may have administrative permissions and may be necessary for initial configuration of the device. It is general best practice to change the passwords for these accounts as soon as possible, but some manufacturers may have devices that have passwords or usernames that cannot be changed.[1]
Default credentials are normally documented in an instruction manual that is either packaged with the device, published online through official means, or published online through unofficial means. Adversaries may leverage default credentials that have not been properly modified or disabled.
| ID | Name | Description |
|---|---|---|
| C0063 | 2025 Poland Wiper Attacks |
During the 2025 Poland Wiper Attacks, the adversaries used default credentials to access Hitatchi RTUs, Mikronika RTUs, Hitachi Relion Protection and Control Relays, Mikronika HMI Computers, and Moxa NPort Serial Device Servers.[2] |
| C0066 | 2026 U.S. Water Utilities Attacks |
During the 2026 U.S. Water Utilities Attacks, the adversary logged in to internet-exposed PLCs using default credentials.[3] |
| G1027 | CyberAv3ngers |
During the 2026 Iranian Water Campaign, CyberAv3ngers accessed internet-accessible equipment using default credentials.[3][4] |
| C0031 | Unitronics Defacement Campaign |
During the Unitronics Defacement Campaign, the CyberAv3ngers discovered and exploited default credentials found on many Unitronics Programmable Logic Controller (PLC) Human-Machine Interface (HMI). For many of these devices, the default password was set to ‘1111’.[5][6] |
| ID | Mitigation | Description |
|---|---|---|
| M0801 | Access Management |
Ensure embedded controls and network devices are protected through access management, as these devices often have unknown default accounts which could be used to gain unauthorized access. |
| M0927 | Password Policies |
Review vendor documents and security alerts for potentially unknown or overlooked default credentials within existing devices. |
| ID | Name | Analytic ID | Analytic Description |
|---|---|---|---|
| DET0756 | Detection of Default Credentials | AN1888 |
Real-time monitoring identifies successful authentication to an Industrial Control System (ICS) application such as a Human-Machine Interface (HMI), historian, Supervisory Control and Data Acquisition (SCADA) server using credentials matching known default vendor passwords, from a logon source not associated with any authorized user. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. |
| AN2193 |
Real-time monitoring identifies authentication attempts against Industrial Control System (ICS) network device management interfaces using well-known default vendor credentials from source Internet Protocol (IP) addresses not in the approved Network Management System (NMS) Classless Inter-Domain Routing (CIDR) subnet range. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. |
||
| AN2218 |
Real-time monitoring identifies successful authentication to a field device using credentials matching documented vendor-default values, from a source not in the approved access list. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. |
||
| AN2255 |
Real-time monitoring identifies successful Secure Shell (SSH) or application authentication using credentials matching known default vendor passwords on Industrial Control System (ICS) Linux assets. OT operational-fidelity gate: Alert only when the account/device/session violates the approved identity + source host/jump path/zone policy and is corroborated by access to a protected OT asset, execution, configuration change, or another security-relevant follow-on event. Suppress approved shift activity, vendor support, break-glass use, commissioning, and documented remote-access windows. |