Restore User Account Access

6 techniques, 24 ATT&CK ids including sub-techniques. Links open MITRE ATT&CK.

• T1078Valid Accounts
  .001 Default Accounts.002 Domain Accounts.003 Local Accounts.004 Cloud Accounts
• T1087Account Discovery
  .001 Local Account.002 Domain Account.004 Cloud Account
• T1098Account Manipulation
  .001 Additional Cloud Credentials.002 Additional Email Delegate Permissions.003 Additional Cloud Roles.004 SSH Authorized Keys.005 Device Registration.006 Additional Container Cluster Roles.007 Additional Local or Domain Groups
• T1136Create Account
  .001 Local Account.002 Domain Account.003 Cloud Account
• T1531Account Access Removal
• T1548Abuse Elevation Control Mechanism
  .005 Temporary Elevated Cloud Access

Marked techniques are also explained, with detection notes and certification relevance, on our interactive ATT&CK map.