Patchfirst
T1531Impact

Account Access Removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious…

attack.mitre.org ↗
CVEs2
In 1
Reports0

Detections

9 Sigma rules tagged T1531

Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.

CVEs linked to Account Access Removal

2 CVEs, by priority. Each link shows its badge.
  1. CVE-2023-34362Progress MOVEit Transfer SQL Injection Vulnerability
    Progress · MOVEit TransferKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+5 more · 2 reports
    MITRE CTID mapping of the KEV entry · follow-on activity
    99.9%Top 0.03%
    86.0priority
  2. CVE-2019-1689Cisco Webex Teams for iOS Arbitrary File Upload Vulnerability
    Cisco · Cisco Webex TeamsHigh · 7.3T1105Ingress Tool TransferT1531Account Access Removal+1 more
    MITRE CTID mapping of the CVE · follow-on activity
    1.6%Top 25%
    20.2priority
↑ ↓ chooseEnter openEsc close