| name | T1531_account-access-removal |
| description | Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. |
| category | business-logic |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1531","impact","linux","macos","windows","saas","iaas","office-suite","esxi"] |
| technique_id | T1531 |
| tactic | impact |
| all_tactics | ["impact"] |
| platforms | ["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"] |
| mitre_url | https://attack.mitre.org/techniques/T1531 |
| tech_stack | ["linux","macos","windows","saas","cloud","office","esxi"] |
| cwe_ids | ["CWE-400"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1531 Account Access Removal
High-Level Description
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.
In Windows, Net utility, Set-LocalUser and Set-ADAccountPassword PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the passwd utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (system account set, system account remove).
Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.
Kill Chain Phase
Platforms: Linux, macOS, Windows, SaaS, IaaS, Office Suite, ESXi
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: Change User Password - Windows
Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
the password "HuHuHUHoHo283283".
Supported Platforms: windows
Elevation Required: Yes
net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} #{new_password}
Atomic Test 2: Delete User - Windows
