Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.[1] Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.[2][3]
In Windows, Net utility, Set-LocalUser and Set-ADAccountPasswordPowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the passwd utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (system account set, system account remove).
Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.
56th pctamong all ATT&CK techniques for number of groups
2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has removed a targeted organization's global admin accounts to lock the organization out of all access.1
created 2022-06-091 referenceaka DEV-0537
All 2 groups for this technique
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
Changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.1
MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Account Access Removal via Multi-Platform Audit Correlation
Enterprise
6 platforms
AN0334 · Windows
Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
UserContext
Account performing the operation (e.g., Domain Admins vs. local users)
TimeWindow
Alert only on actions outside of maintenance windows
ParentProcessName
Detect suspicious process lineage (e.g., powershell.exe launching net.exe)
AN0335 · Linux
Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
method=RemoveUser or esxcli system account remove invocation
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
RemoteUserRole
ESXi role triggering the change (e.g., Administrator vs. Viewer)
ExpectedIPs
IP ranges authorized to conduct admin-level actions
AN0338 · Office Suite
O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
RoleAssignment
Determine if operation was delegated to expected admin group
GeoThreshold
Trigger on unusual geographic login sources
AN0339 · SaaS
Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
BulkActionThreshold
Trigger if multiple deletions occur within a short period
SessionDeviceType
Alert on deletions initiated from unfamiliar device contexts
Tests8Executorspowershell 3 · sh 3 · command_prompt 2Need elevation5 of 8Have prerequisites3Have cleanup5Platformswindows, macos, linux, azure-ad
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
Change User Password - Windows
windows
command_prompt
Required
—
Yes
Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
the password "HuHuHUHoHo283283".
Inputs
Name
Description
Type
Default Value
new_password
New password for the specified account.
string
HuHuHUHoHo283283@dJD
user_account
User account whose password will be changed.
string
AtomicAdministrator
new_user_password
Password to use if user account must be created first
string
User2ChangePW!
Attack Commandsrun with command_promptelevation required (root or admin)
net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} #{new_password}
Cleanup Commands
net.exe user #{user_account} /delete >nul 2>&1
GUID1b99ef28-f83c-4ec5-8a08-1a56263a5bb2
02
Delete User - Windows
windows
command_prompt
Required
—
—
Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.
Inputs
Name
Description
Type
Default Value
user_account
User account to be deleted.
string
AtomicUser
new_user_password
Password to use if user account must be created first
string
User2DeletePW!
Attack Commandsrun with command_promptelevation required (root or admin)
net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} /delete
GUIDf21a1d7d-a62f-442a-8c3a-2440d43b19e5
03
Remove Account From Domain Admin Group
windows
powershell
—
1
—
This test will remove an account from the domain admins group
Inputs
Name
Description
Type
Default Value
super_pass
super_user account password.
string
password
super_user
Account used to run the execution command (must include domain).
string
domain\super_user
remove_user
Account to remove from domain admins.
string
remove_user
Attack Commandsrun with powershell
$PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
} else{
write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
}
Dependenciesrun with powershell
Description
Requires the Active Directory module for powershell to be installed.
Deletes a user in Azure AD. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (excluding changed credentials) to remove access to accounts.
Inputs
Name
Description
Type
Default Value
userprincipalname
User principal name (UPN) for the Azure user being deleted
echo "use the following to install AzureAD PowerShell module - Install-Module -Name AzureAD -Scope CurrentUser -Repository PSGallery -Force"
Description
Check if AzureAD PowerShell module is installed
Check Prereq Commands
Update the input arguments so the userprincipalname value is accurate for your environment
Get Prereq Commands
echo "Update the input arguments in the .yaml file so that the userprincipalname value is accurate for your environment"
GUID4f577511-dc1c-4045-bcb8-75d2457f01f4
08
Azure AD - Delete user via Azure CLI
azure-ad
powershell
—
3
Yes
Deletes a user in Azure AD. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (excluding changed credentials) to remove access to accounts.
Inputs
Name
Description
Type
Default Value
userprincipalname
User principal name (UPN) for the Azure user being deleted
string
atomicredteam@yourdomain.com
Attack Commandsrun with powershell
az login
$userprincipalname = "#{userprincipalname}"
az ad user delete --id $userprincipalname
Cleanup Commands
N/A
Dependenciesrun with powershell
Description
Check if Azure CLI is installed and install manually
Check Prereq Commands
az account list
Get Prereq Commands
echo "use the following to install the Azure CLI manually https://aka.ms/installazurecliwindows"
Description
Check if Azure CLI is installed and install via PowerShell
Check Prereq Commands
az account list
Get Prereq Commands
echo "use the following to install the Azure CLI $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'; Remove-Item .\AzureCLI.msi"
Description
Update the userprincipalname to meet your requirements
Check Prereq Commands
Update the input arguments so the userprincipalname value is accurate for your environment
Get Prereq Commands
echo "Update the input arguments in the .yaml file so that the userprincipalname value is accurate for your environment"