Every technique
T1640Not expressible in SigmaMOBILE
Account Access Removal
ImpactAndroid
Where this stands
No Sigma rule can address this — the telemetry MITRE names has no Sigma logsource behind it.
Sigma has no logsource taxonomy for mobile platforms. MITRE's telemetry here is mobile EDR and device APIs, which no Sigma rule can address.
What the technique is
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: credentials changed) to remove access to accounts.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1655
Application vetting services could closely scrutinize applications that request Device Administrator permissions.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.