Poisoned Pipeline / Mitigations / M1131

M1131

Disable or lock compromised accounts

Disable or lock the compromised user account to prevent further unauthorized access.
This can be done through an administrative action, such as disabling the account in the user management console or contacting the service provider or IT department to take appropriate action.

Applies to

• T0113 Compromised user account
• T0114 Compromised service account

References

• https://auth0.com/docs/secure/attack-protection/breached-password-detection