1200KM / simulation
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place. In Windows, Net utility,…
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.[Obsidian Security SaaS Ransomware June 2023] Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.[CarbonBlack LockerGoga 2019][Unit42 LockerGoga 2019]
In Windows, Net utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`).
Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.
Official technique definition · Open in the interactive matrix
These contracts are selected through exact technique-to-data-component relationships or explicitly labelled planning overrides. Configure a collector at the relevant observation point; a telemetry name alone is not coverage.
DC0064 collection page — Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.
Required normalized fields: interpreter, command_line, actor_uid, session_id.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0064",
"collector": "illustrative-lab-collector",
"observation": {
"interpreter": "/bin/sh",
"command_line": "printf LAB_TELEMETRY_CHECK",
"actor_uid": 1000,
"session_id": "lab-session-1"
}
}Visibility limits: Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.
DC0032 collection page — Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.
Required normalized fields: process_guid, image, parent_image, command_line, user.
<EventFiltering>
<ProcessCreate onmatch="include">
<Image condition="is">C:\Windows\System32\whoami.exe</Image>
</ProcessCreate>
</EventFiltering>This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0032",
"collector": "illustrative-lab-collector",
"observation": {
"process_guid": "lab-process-001",
"image": "C:\\Windows\\System32\\whoami.exe",
"parent_image": "C:\\Windows\\System32\\cmd.exe",
"command_line": "whoami",
"user": "LAB\\analyst"
}
}Visibility limits: Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.
DC0002 collection page — Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.
Required normalized fields: account, application, result, reason, source_ip.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0002",
"collector": "illustrative-lab-collector",
"observation": {
"account": "analyst@example.test",
"application": "lab-portal",
"result": "failure",
"reason": "invalid_credential",
"source_ip": "192.0.2.10"
}
}Visibility limits: A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.
DC0009 collection page — Enable Audit User Account Management on the responsible Windows host/controller; export equivalent cloud directory audit where applicable.
Required normalized fields: actor, target_account, action, result.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0009",
"collector": "illustrative-lab-collector",
"observation": {
"actor": "lab-admin",
"target_account": "lab-temp",
"action": "delete",
"result": "success"
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
DC0010 collection page — Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.
Required normalized fields: target_account, attribute, before, after.
Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.
{
"schema": "1200km.telemetry.example.v1",
"synthetic": true,
"timestamp": "2026-09-27T12:00:00Z",
"telemetry_id": "DC0010",
"collector": "illustrative-lab-collector",
"observation": {
"target_account": "lab-temp",
"attribute": "enabled",
"before": false,
"after": true
}
}Visibility limits: A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.
Open the dedicated detection workspace · Existing query engineering
Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.
Platforms: Windows.
Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.
Platforms: Linux.
Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.
Platforms: macOS.
Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.
Platforms: ESXi.
O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.
Platforms: Office Suite.
Deletion or disablement of user accounts in SaaS platforms such as Okta, Salesforce, or Zoom, correlated with anomalous administrative session attributes or multiple account-removal actions within a short duration.
Platforms: SaaS.
9 exact-tagged source rules. A source tag is a discovery aid, not a relevance verdict. Check the observation point and actual condition of each rule.
MATCH(account_disabled_or_deleted OR credential_reset OR role_removed) AND actor NOT_IN approved_identity_admins -> ALERTNo exact technique-specific Atlas model is present for T1531 in the selected source snapshot. The following is a design worksheet, not a newly validated model.
Start from the exact analytic above. The collection-specific lenses below are analyst recommendations; they do not assert that an arbitrary statistical deviation detects this technique.
Anomaly Detection Atlas · Baseline, validation and blind spots
No reviewed lab-tool association is selected for this exact technique. This is a curation gap, not a statement that no tool can implement the behavior.
These are exact ATT&CK software-use relationships, including malware. They provide behavior context, not recommendations to download or execute malware. No safety or detector claim is inherited.
LockerGoga has been observed changing account passwords and logging off current users.[CarbonBlack LockerGoga 2019][Unit42 LockerGoga 2019]
Exact relationship: relationship--57385cb2-e3ef-4006-b465-a5a48632d02bMegaCortex has changed user account passwords and logged users off the system.[IBM MegaCortex]
Exact relationship: relationship--46250897-5a79-4401-b965-da8115a60d7fMeteor has the ability to change the password of local users on compromised hosts and can log off users.[Check Point Meteor Aug 2021]
Exact relationship: relationship--9a8901ea-5cb3-431f-9be8-55986ea41448DEADWOOD changes the password for local and domain users via <code>net.exe</code> to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the <code>winlogon.exe</code> process to prevent attempts to log on to the infected system.[SentinelOne Agrius 2021]
Exact relationship: relationship--ca8e4853-3214-4073-86ea-ca6cd62c1effAtomic evidence: 6 compatible documented candidates. Live lab status: not run for these imported procedures.
Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.
Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with
the password "HuHuHUHoHo283283".
Pinned Atomic procedure · 1b99ef28-f83c-4ec5-8a08-1a56263a5bb2 · windows · command_prompt.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
user_account: User account whose password will be changed. (type string; source default AtomicAdministrator)new_user_password: Password to use if user account must be created first (type string; source default User2ChangePW!)new_password: New password for the specified account. (type string; source default HuHuHUHoHo283283@dJD)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
This test changes the user password to hinder access to the account using passwd utility.
Pinned Atomic procedure · 3c717bf3-2ecc-4d79-8ac8-0bfbf08fbce6 · macos, linux · sh.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
user_account: User account whose password will be changed. (type string; source default ARTUser)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
This test will remove an account from the domain admins group
Pinned Atomic procedure · 43f71395-6c37-498e-ab17-897d814a0947 · windows · powershell.
Elevation: not declared required. Cleanup: not declared. This is source documentation, not an execution approval.
super_user: Account used to run the execution command (must include domain). (type string; source default domain\super_user)super_pass: super_user account password. (type string; source default password)remove_user: Account to remove from domain admins. (type string; source default remove_user)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
1 prerequisite definitions:
This test deletes the user account using the dscl utility.
Pinned Atomic procedure · 4d938c43-2fe8-4d70-a5b3-5bf239aa7846 · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
user_account: User account which will be deleted. (type string; source default ARTUser)user_password: User password. (type string; source default ARTPassword)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
This test deletes the user account using the sysadminctl utility.
Pinned Atomic procedure · d3812c4e-30ee-466a-a0aa-07e355b561d6 · macos · sh.
Elevation: required. Cleanup: defined upstream; review required. This is source documentation, not an execution approval.
user_account: User account which will be deleted. (type string; source default ARTUserAccount)user_name: New user name. (type string; source default ARTUser)user_password: New user password. (type string; source default ARTPassword)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.
Pinned Atomic procedure · f21a1d7d-a62f-442a-8c3a-2440d43b19e5 · windows · command_prompt.
Elevation: required. Cleanup: not declared. This is source documentation, not an execution approval.
new_user_password: Password to use if user account must be created first (type string; source default User2DeletePW!)user_account: User account to be deleted. (type string; source default AtomicUser)Review the upstream command, dependencies and cleanup at the source link. Source defaults may refer to real infrastructure or destructive actions; they are not authorized targets. No automatic install, prerequisite download or command execution is provided.
Download synthetic collection fixture (JSON) · Download the complete engineering workbook
This fixture exercises the listed collection fields. It does not reproduce Account Access Removal, label its example events as malicious, or measure detection effectiveness. Use the exact analytic and selected procedure to build an independently labelled behavior-positive dataset.
Not run in this browser. No network scan or attack command is executed by this control.
All-page audit and evidence inventory · This page’s machine-readable workbook
Pinned MITRE STIX source · SHA-256 81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352. Definition and procedure context are reproduced from this snapshot, not independently re-investigated incidents.
Source procedure platform / method / executor tags:
No reviewed association in this snapshot.
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Pinned research references. No browser attack runner or production-validated detector is asserted. Imported procedures remain unvalidated; any bounded lab evidence has its own scope. ATT&CK / Atomic provenance · Detection provenance.