Monitor network traffic for default credential use in protocols that allow unencrypted authentication.
Monitor logon sessions for default credential use.
| Data Component | Name | Channel |
|---|---|---|
| Network Traffic Content (DC0085) | Network Traffic | None |
| Logon Session Creation (DC0067) | Logon Session | None |