帐户访问权限删除

攻击者可能会禁止访问合法用户使用的帐户，从而中断系统和网络资源的可用性。可以删除，锁定或操纵帐户（例如更改凭据）以删除对帐户的访问。

攻击者还可能随后注销和/或重新启动框以将恶意更改设置到位

Account Access Removal

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.

Adversaries may also subsequently log off and/or reboot boxes to set malicious changes into place

标签

策略： 影响( Impact )

平台： Linux，macOS，Windows

所需权限： user，administrator，root，SYSTEM

数据源： Windows事件日志，进程命令行参数，进程监视

影响类型： 可用性( Availability )

程序示例

名称	描述
LockerGoga	发现LockerGoga会更改帐户密码并注销当前用户（LockerGoga has been observed changing account passwords and logging off current users.）

缓解措施

这种攻击技术无法通过预防性控制轻松缓解，因为它基于滥用系统功能。

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

检测

使用过程监视来监视与删除帐户或更改密码有关的二进制文件的执行和命令行参数，例如使用Net。Windows事件日志还可以指定与对手试图删除对帐户的访问权相关的活动：

• 事件ID 4723-试图更改帐户密码
• 事件ID 4724-尝试重置帐户密码
• 事件ID 4726-用户帐户已删除
• 事件ID 4740-用户帐户被锁定

网络警报和这些事件ID可能会产生很高的误报率，因此请与有关系统通常使用方式的基准知识进行比较，并在可能的情况下将修改事件与其他恶意活动指示相关联。

Use process monitoring to monitor the execution and command line parameters of binaries involved in deleting accounts or changing passwords, such as use of Net. Windows event logs may also designate activity associated with an adversary's attempt to remove access to an account:

• Event ID 4723 - An attempt was made to change an account's password
• Event ID 4724 - An attempt was made to reset an account's password
• Event ID 4726 - A user account was deleted
• Event ID 4740 - A user account was locked out

Alerting on Net and these Event IDs may generate a high degree of false positives, so compare against baseline knowledge for how systems are typically used and correlate modification events with other indications of malicious activity where possible.