T1531Impact
Account Access Removal
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious…
CVEs2
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.1
Reports0
Detections
9 Sigma rules tagged T1531Account Access RemovalT15319 general rules
- Azure Kubernetes Service Account Modified or Deletedmediumtest
- Google Cloud Service Account Disabled or Deletedmediumtest
- Group Has Been Deleted Via Groupdelmediumtest
- Okta User Account Locked Outmediumtest
- Remove Account From Domain Admin Groupmediumtest
- User Has Been Deleted Via Userdelmediumtest
- AWS SAML Provider Deletion Activitymediumexperimental
- AWS ElastiCache Security Group Modified or Deletedlowtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Account Access Removal
2 CVEs, by priority. Each link shows its badge.- CVE-2023-34362Progress MOVEit Transfer SQL Injection VulnerabilityProgress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reportsMITRE CTID mapping of the KEV entry · follow-on activity99.9%Top 0.03%86.0priority
- CVE-2019-1689Cisco Webex Teams for iOS Arbitrary File Upload VulnerabilityMITRE CTID mapping of the CVE · follow-on activity1.6%Top 25%20.2priority