https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364496#M3615 <P>That lookup have only 30+ default usernames and we don't know topicality of there names.<BR /> So, any another solutions? </P> Tue, 20 Mar 2018 22:25:01 GMT test_qweqwe 2018-03-20T22:25:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364494#M3613 <P>Hi.<BR /> I see dashboard in ES 4.1.1 aka "Default Account Activity", but he shows activity of all accounts.</P> <P>How to detect Default Account? Any solutions?<BR /> Maybe someone can share list of all default accounts? (I'm tried to google, but got unsatisfactory results).</P> <P>By "Default Account" i mean:</P> <PRE><CODE>"Discovers use of default accounts (such as admin, administrator, etc.). Default accounts have default passwords and are therefore commonly targeted by attackers using brute force attack tools." </CODE></PRE> Mon, 19 Mar 2018 21:40:17 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364494#M3613 test_qweqwe 2018-03-19T21:40:17Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364495#M3614 <P>Hey</P> <P>Are you looking for the Administrative lookup of ES?</P> <PRE><CODE>/en-US/app/SplunkEnterpriseSecuritySuite/ess_lookups_edit?namespace=SA-IdentityManagement&amp;transform=administrative_identity_lookup </CODE></PRE> <P>Or is it the case that all your logins are being wrongfully tagged with tag="default"?</P> <P>Look at the DataSet definition </P> <PRE><CODE>**Default Authentication** (`cim_Authentication_indexes`) tag=authentication NOT (action=success user=*$) Constraint tag="default" </CODE></PRE> Tue, 20 Mar 2018 07:46:31 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364495#M3614 tiagofbmm 2018-03-20T07:46:31Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364496#M3615 <P>That lookup have only 30+ default usernames and we don't know topicality of there names.<BR /> So, any another solutions? </P> Tue, 20 Mar 2018 22:25:01 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364496#M3615 test_qweqwe 2018-03-20T22:25:01Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364497#M3616 <P>Or, how to search default accounts by Splunk?<BR /> Because I see all users are listed in the results not just default accounts like admins and the like.</P> Tue, 20 Mar 2018 23:13:32 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364497#M3616 test_qweqwe 2018-03-20T23:13:32Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364498#M3617 <P>This behaviour is not related to that Lookup. It is actually related to how your events are arriving to Splunk and how they are tagged in the sourcetypes. </P> <P>For instance if you have WinEventLog:Security, SYSTEM account is considered by the Splunk_TA_for_Windows as a default account ant therefore tagged as tag=default, and so it shows up in that correlation search.</P> <P>You should try to understand why are your events tagged with tag=default in one of the sourcetypes you are getting wrongful data.</P> Tue, 29 Sep 2020 18:35:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364498#M3617 tiagofbmm 2020-09-29T18:35:24Z https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364499#M3618 <P>In my case I am not getting a single default login</P> Sun, 09 Feb 2020 03:11:24 GMT https://community.splunk.com/t5/Splunk-Enterprise-Security/How-to-detect-default-accounts-by-Splunk/m-p/364499#M3618 dikshaj 2020-02-09T03:11:24Z