id: default-admin-account-enabled

info:
  name: Default Administrator Account Enabled
  author: boonchuan
  severity: medium
  description: |
    Detected built-in Administrator account was enabled, which is a common target for brute-force and credential stuffing attacks.
  impact: |
    The default Administrator account has a well-known SID and is frequently targeted by attackers. Leaving it enabled increases the attack surface.
  remediation: |
    Disable the built-in Administrator account and use a separate named admin account for administrative tasks. Run: net user Administrator /active:no
  reference:
    - https://www.cyber.gov.au/acsc/view-all-content/publications/essential-eight-maturity-model
    - https://learn.microsoft.com/en-us/windows/security/identity-protection/access-control/local-accounts
  metadata:
    verified: false
  tags: windows,admin,privileges,compliance,essential-eight,code,windows-audit

code:
  - pre-condition: |
      IsWindows();
    engine:
      - powershell
      - powershell.exe
    args:
      - -ExecutionPolicy
      - Bypass
    pattern: "*.ps1"
    source: |
      $admin = Get-LocalUser -Name 'Administrator' -ErrorAction SilentlyContinue; if ($admin -and $admin.Enabled) { 'True' } else { 'False' }
    matchers:
      - type: word
        words:
          - "True"
# digest: 4a0a00473045022100f0b58e6b5a9b3631af0243f2f37b0b73fe428c208fd97eee1512c86e5ad67a0f02207f8e08fa3081b1e0b8b787e3dee5b2353a994b01ac1a861e1d73f58840f7e80d:922c64590222798bb761d5b6d8e72950