MITRE D3FENDdefensive technique

D3-AL Account Locking

Official page ↗
Tactic
Evict

Definition

The process of temporarily disabling user accounts on a system or domain.

How it works

How it works Management servers with enterprise policies for account management provide the ability to enable and disable account for given rules. The rules may include specific periods of time (eg. weekend, plant shutdown, leave periods), specific user types or groups, or individual users. Considerations • Local accounts caches vs centralized account management • Single Sign-on • Role based vs Attribute based systems Examples of account configuration stores • Directory Services • Active Directory • RADIUS • LDAP • Oracle User Account Management • JumpCloud

Related

Counters · MITRE ATT&CK (20)

  • T1548.005 Temporary Elevated Cloud Access sub-technique
  • T0859 Valid Accounts technique
  • T1078.001 Default Accounts sub-technique
  • T1078.002 Domain Accounts sub-technique
  • T1078.003 Local Accounts sub-technique
  • T1078.004 Cloud Accounts sub-technique
  • T1087.001 Local Account sub-technique
  • T1087.002 Domain Account sub-technique
  • T1087.004 Cloud Account sub-technique
  • T1548 Abuse Elevation Control Mechanism technique
  • T1136.003 Cloud Account sub-technique
  • T1136.001 Local Account sub-technique
  • T1136.002 Domain Account sub-technique
  • T1098.002 Additional Email Delegate Permissions sub-technique
  • T1098.003 Additional Cloud Roles sub-technique
  • T1531 Account Access Removal technique
  • T1136 Create Account technique
  • T1078 Valid Accounts technique
  • T1087 Account Discovery technique
  • T1098 Account Manipulation technique

Child of · MITRE D3FEND (1)

  • D3-CE Credential Eviction defensive technique

References