User Account Management

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

An adversary must already have administrator level access on the local system to make full use of this technique; be sure to restrict users and accounts to the least privileges they require.

Ensure that low-privileged user accounts do not have permission to add access keys to accounts.

Ensure that low-privileged user accounts do not have permissions to add permissions to accounts or update IAM policies.

In cloud environments, ensure that only users who explicitly require the permissions to update instance metadata or configurations can do so.

Use MDM to disable user's ability to install or approve kernel extensions, and ensure all approved kernel extensions are in alignment with policies specified in com.apple.syspolicy.kernel-extension-policy.(Citation: Apple TN2459 Kernel Extensions)(Citation: MDMProfileConfigMacOS)

Limit permissions for who can create symbolic links in Windows to appropriate groups such as Administrators and necessary groups for virtualization. This can be done through GPO: Computer Configuration > [Policies] > Windows Settings > Security Settings > Local Policies > User Rights Assignment: Create symbolic links. (Citation: UCF STIG Symbolic Links)

Limit user accounts that can load or unload device drivers by disabling SeLoadDriverPrivilege.

Limit privileges of user accounts so only authorized privileged users can create and modify XDG autostart entries.

Proactively reset accounts that are known to be part of breached credentials either immediately, or after detecting bruteforce attempts.

Restrict user's abilities to create Launch Agents with group policy.

Limit user access to system utilities such as 'systemctl' to only users who have a legitimate need.

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service configurations.

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new Launch Daemons.

Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.

Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization.

Enforce the principle of least-privilege. Consider implementing access control mechanisms that include both authentication and authorization for code repositories.

Consider implementing WMI and security filtering to further tailor which users and computers a GPO will apply to.(Citation: Wald0 Guide to GPOs)(Citation: Microsoft WMI Filters)(Citation: Microsoft GPO Security Filtering)

Ensure that user accounts with administrative rights follow best practices, including use of privileged access workstations, Just in Time/Just Enough Administration (JIT/JEA), and strong authentication. Reduce the number of users that are members of highly privileged Directory Roles.(Citation: Microsoft SolarWinds Customer Guidance)

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.

Limit privileges of user accounts and groups so that only authorized administrators can interact with service changes and service binary target path locations. Deny execution from user directories such as file download directories and temp directories where able.

Limit the privileges of user accounts so that only authorized administrators can edit system environment variables.

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with security services.

Ensure proper user permissions are in place to prevent adversaries from disabling or interfering with logging.

Ensure proper user permissions are in place to prevent adversaries from disabling or modifying firewall settings.

Ensure event tracers/forwarders (Citation: Microsoft ETW May 2018), firewall policies, and other associated mechanisms are secured with appropriate permissions and access controls and cannot be manipulated by user accounts.

Ensure least privilege principles are applied to Identity and Access Management (IAM) security policies.(Citation: Expel IO Evil in AWS)

Configure default account policy to enable logging. Manage policies to ensure only necessary users have permissions to make changes to logging policies.

Ensure that proper policies are implemented to dictate the secure enrollment and deactivation of MFA for user accounts.

Limit permissions for creating snapshots or backups in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.(Citation: Mandiant M-Trends 2020)

Limit permissions for creating new instances in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.(Citation: Mandiant M-Trends 2020)

Limit permissions for deleting new instances in accordance with least privilege. Organizations should limit the number of users within the organization with an IAM role that has administrative privileges, strive to reduce all permanent privileged role assignments, and conduct periodic entitlement reviews on IAM users, roles and policies.(Citation: Mandiant M-Trends 2020)

Limit remote user permissions if remote access is necessary.

Limit remote user permissions if remote access is necessary.

Limit which user accounts are allowed to login via SSH.

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems. In Linux environments, users account-level access to at can be managed using at.allow and at.deny files. Users listed in the at.allow are enabled to schedule actions using at, whereas users listed in at.deny file disabled from the utility.

cron permissions are controlled by /etc/cron.allow and /etc/cron.deny. If there is a cron.allow file, then the user or users that need to use cron will need to be listed in the file. cron.deny is used to explicitly disallow users from using cron. If neither files exist, then only the super user is allowed to run cron.

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create new Launch Daemons.

Limit privileges of user accounts and remediate Privilege Escalation vectors so only authorized administrators can create scheduled tasks on remote systems.

Limit user access to system utilities such as 'systemctl' or 'systemd-run' to users who have a legitimate need.

Limit privileges of user accounts and remediate privilege escalation vectors so only authorized administrators can create container orchestration jobs.

Enforce the principle of least privilege by limiting privileges of user accounts so only authorized accounts can modify the web directory.(Citation: NSA and ASD Detect and Prevent Web Shells 2020)

Prevent users from installing their own launch agents or launch daemons.

Do not allow a domain user to be in the local administrator group on multiple systems.

Do not allow a user to be a local administrator for multiple systems.

Periodically review user accounts and remove those that are inactive or unnecessary. Limit the ability for user accounts to create additional accounts.