Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.1 Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.23 In Windows, Net utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.
- Obsidian Security SaaS Ransomware June 2023
- CarbonBlack LockerGoga 2019
- Unit42 LockerGoga 2019
Groups using this technique
| Group | Name | Country |
|---|---|---|
| grp_g1024 | Akira | — |
| grp_g1004 | LAPSUS$ | — |
Claims
No public claim points at this technique yet.
Auto-ingested and not human-reviewed; confidence and validity read by citation.