T1531 Account Access Removal — ATT&CK Technique
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place. In Windows, Net utility, Set-LocalUser and Set-ADAccountPassword PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the passwd utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.
Detection coverage (15)
- Okta User Account Locked Out medium
- AWS ElastiCache Security Group Modified or Deleted low
- AWS SAML Provider Deletion Activity medium
- Azure Kubernetes Service Account Modified or Deleted medium
- Google Cloud Service Account Disabled or Deleted medium
- Group Has Been Deleted Via Groupdel medium
- User Has Been Deleted Via Userdel medium
- User Logoff Event informational
- Remove Account From Domain Admin Group medium
- Cisco ASA - User Account Deleted From Local Database
- Windows Account Access Removal via Logoff Exec
- Windows Excessive Usage Of Net App
- Windows Powershell Logoff User via Quser
- Windows User Deletion Via Net
- Windows User Disabled Via Net