Insecure Credentials

Adversaries may target insecure credentials as a means to persist on a system or device or move laterally from one system or device to another. Insecure credentials may appear as default credentials which are pre-configured credentials on a system, device, or software that are well-known in documentation or hard-coded credentials which are built into the system, device, or software that cannot be changed or not easily changed because of the impact on control processes.[1][2][3]
Adversaries often times use insecure credentials to evade detection as they are typically forgotten about by system and device owners.

ID: T1694
Sub-techniques:  T1694.001, T1694.002
Version: 1.0
Created: 20 April 2026
Last Modified: 23 April 2026

Targeted Assets

ID Asset
A0008 Application Server
A0007 Control Server
A0009 Data Gateway
A0006 Data Historian
A0017 Distributed Control System (DCS) Controller
A0013 Field I/O
A0016 Firewall
A0002 Human-Machine Interface (HMI)
A0005 Intelligent Electronic Device (IED)
A0012 Jump Host
A0018 Programmable Automation Controller (PAC)
A0003 Programmable Logic Controller (PLC)
A0004 Remote Terminal Unit (RTU)
A0014 Routers
A0010 Safety Controller
A0015 Switch
A0011 Virtual Private Network (VPN) Server
A0001 Workstation

Mitigations

ID Mitigation Description
M0801 Access Management

Ensure embedded controls and network devices are protected through access management, as these devices often have insecure credentials which could be used to gain unauthorized access.

Detection Strategy

ID Name Analytic ID Analytic Description
DET0905 Detection of Insecure Credentials AN2048

Monitor network traffic for insecure credential use in protocols that allow unencrypted authentication.

Monitor logon sessions for insecure credential use, when feasible.

References