Hello and welcome to another
application of the mind or attack
framework discussion today
we're going to be looking at account
access removal.
So with that, let's jump straight
in to our objectives.
So today's objectives are as
follows. We're going to describe
account access removal, what
are some mitigation techniques and
some detection techniques as
well.
So perminder account
access removal is when a threat
occur, interrupts availability of a
system or network by inhibiting
access to accounts utilized
by legitimate users.
This can be that the account is
deleted, locked or the
credentials are changed or
manipulated.
So this could be like if you've got
a weak password on an account and
it is compromised and then
multifactor is put in place.
But it's not your multifactor.
You are effectively locked out
of that account until you can get in
touch with someone who can help you
to resolve the issue.
A particular tool in this
would be locker Goga.
And so this tool is a
ransomware tool that has been tied
to various attacks in European
companies or on European companies,
has the ability to change account
passwords along users of
disable AV with
task kill commands, delete its
original launcher after execution
and can shut down infected systems.
Definitely sounds like something
that would be nasty to have.
Mitigation techniques here are going
to be really based around in user
awareness. Training to reduce the
potential of infection
detection techniques are going just
around looking at IDs
as follows.
Forty to twenty or forty seven.
Twenty three, which is an attempt
made to change account passwords.
Forty seven, twenty four attempts
made to reset an accounts password.
Forty seven twenty six account was
deleted. Forty seven forty.
A user account was locked out.
And so if you're going to monitor
for anything that is account
related, these are definitely some
key areas to focus on
so that you could potentially see
when a threat actor may be doing
some things that could lead
eventually to account lockout or
deletion, and you could at least
track it back to origination and
hopefully deal with the issue.
So with that, let's do a quick check
on learning true or false
account access removal is when a
threat actor attempts to keep the
intended user of a system
from getting back into the system.
All right, so if you need additional
time, please pass the video.
So in this case, the count access
removal in cases is
when a threat actor attempts to keep
the intended user of a system
from getting back into a system.
So this is a true
statement.
Now, in summary of today's
discussion, we
described account access removal.
Again, this is account manipulation
changes, modifications that keep the
intended user out.
Mitigation techniques are going to
be revolving around in user
awareness training to hopefully
prevent threat actors from getting
into systems to begin with.
And then detection techniques
include a number of event IDs
that we use to describe
attempts to delete, modify
or otherwise get into
legitimate user accounts.
So with that in mind, I want to
thank you for your time today, and
I look forward to seeing you again
soon.