Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Adversaries may also subsequently log off and/or reboot boxes to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CVE-2019-1689 | Cisco Webex Teams | secondary_impact | T1531 | Account Access Removal | |
| action.hacking.variety.Unknown | Unknown | related-to | T1531 | Account Access Removal | |
| attribute.integrity.variety.Unknown | Unknown | related-to | T1531 | Account Access Removal | |
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1531 | Account Access Removal |
Comments
The following GuardDuty Finding type flags events where adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Impact:IAMUser/AnomalousBehavior
References
|
| aws_security_hub | AWS Security Hub | technique_scores | T1531 | Account Access Removal |
Comments
AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the modification of accounts. AWS Security Hub provides this detection with the following check.
3.4 Ensure a log metric filter and alarm exist for IAM policy changes
This is scored as Partial because it only supports the monitoring of changes to AWS IAM accounts and not the accounts on instances of operating systems.
References
|