Esc

Account Access Removal - T1531

(ATT&CK® Technique)

Definition

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1531["Account Access Removal"] --> |modifies| UserAccount["User Account"]; class T1531 OffensiveTechniqueNode;
        class UserAccount ArtifactNode; click UserAccount href "/dao/artifact/d3f:UserAccount";
        click T1531 href "/offensive-technique/attack/T1531/"; click UserAccount href "/dao/artifact/d3f:UserAccount";              RestoreUserAccountAccess["Restore User Account Access"] -->
          | restores | UserAccount["User Account"];

          RestoreUserAccountAccess["Restore User Account Access"] -.->
            | may-restore | T1531["Account Access Removal"] ;
          class RestoreUserAccountAccess DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click RestoreUserAccountAccess href "/technique/d3f:RestoreUserAccountAccess"; AccountLocking["Account Locking"] -->
          | disables | UserAccount["User Account"];

          AccountLocking["Account Locking"] -.->
            | may-evict | T1531["Account Access Removal"] ;
          class AccountLocking DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click AccountLocking href "/technique/d3f:AccountLocking"; UserAccountPermissions["User Account Permissions"] -->
          | restricts | UserAccount["User Account"];

          UserAccountPermissions["User Account Permissions"] -.->
            | may-isolate | T1531["Account Access Removal"] ;
          class UserAccountPermissions DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click UserAccountPermissions href "/technique/d3f:UserAccountPermissions";                                                     UnlockAccount["Unlock Account"] -->
          | restores | UserAccount["User Account"];

          UnlockAccount["Unlock Account"] -.->
            | may-restore | T1531["Account Access Removal"] ;
          class UnlockAccount DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click UnlockAccount href "/technique/d3f:UnlockAccount"; AgentAuthentication["Agent Authentication"] -->
          | strengthens | UserAccount["User Account"];

          AgentAuthentication["Agent Authentication"] -.->
            | may-harden | T1531["Account Access Removal"] ;
          class AgentAuthentication DefensiveTechniqueNode;
          class UserAccount ArtifactNode;
          click AgentAuthentication href "/technique/d3f:AgentAuthentication";

json