Techniques › T1531
T1531 Account Access Removal
impact — Linux, macOS, Windows, SaaS, IaaS, Office Suite, ESXi · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
9
Sigma rules tagged attack.t1531
1
KEV CVEs mapped here
<p>Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.</p><p>In Windows, Net utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> PowerShell cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (
system account set, system account remove).</p><p>Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as Data Destruction and Defacement, in order to impede incident response/recovery before completing the Data Encrypted for Impact objective.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2023-34362 | Progress MOVEit Transfer | secondary impact | Mapped | 2023-06-02 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0120 Account Access Removal via Multi-Platform Audit Correlation v1.0
AN0334 WindowsCorrelated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.Tunable:
UserContextTimeWindowParentProcessNameAN0335 LinuxPassword changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.auditd:SYSCALLSYSCALL record where exe contains passwd/userdel/chage and auid != root→ DC0032 Process CreationNSM:ConnectionsAccepted password or publickey for user from remote IP→ DC0002 User Account AuthenticationTunable:ExecPathNonRootUIDThresholdAN0336 macOSExecution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.macos:unifiedlogcommand includes dscl . delete or sysadminctl --deleteUser→ DC0064 Command Executionmacos:unifiedlogsuccessful sudo or authentication for account not normally associated with admin actions→ DC0002 User Account AuthenticationTunable:CommandLinePatternAnomalousUserFlagAN0337 ESXiInvocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.esxi:hostdmethod=RemoveUser or esxcli system account remove invocation→ DC0009 User Account DeletionTunable:RemoteUserRoleExpectedIPsAN0338 Office SuiteO365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.m365:signinlogsSign-in from anomalous location or impossible travel condition→ DC0002 User Account AuthenticationTunable:RoleAssignmentGeoThresholdAN0339 SaaSDeletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.Tunable:BulkActionThresholdSessionDeviceType
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1531
Author: Tuan Le (NCSGroup)
· 2022-12-26 · logsource: product=linux category=process_creation · 08f26069-6f80-474b-8d1f-d971c6fedea0
Detects execution of the "userdel" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks
Author: frack113
· 2022-10-14 · logsource: product=windows service=security · 0badd08f-c6a3-4630-90d3-6875cca440be
Detects a user log-off activity. Could be used for example to correlate information during forensic investigations
Author: Austin Songer @austinsonger
· 2021-08-07 (modified 2022-08-23) · logsource: product=azure service=activitylogs · 12d027c3-b48c-4d9d-8bb6-a732200034b2
Identifies when a service account is modified or deleted.
Author: Austin Songer @austinsonger
· 2021-08-14 (modified 2022-10-09) · logsource: product=gcp service=gcp.audit · 13f81a90-a69c-4fab-8f07-b5bb55416a9f
Identifies when a service account is disabled or deleted in Google Cloud.
Author: Austin Songer @austinsonger
· 2021-09-12 (modified 2026-04-27) · logsource: product=okta service=okta · 14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a
Detects when an user account is locked out.
Author: frack113
· 2021-12-26 · logsource: product=windows category=ps_script · 48a45d45-8112-416b-8a67-46e03a4b2107
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.
Accounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.
Author: Austin Songer @austinsonger
· 2021-07-24 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 7c797da2-9cf2-4523-ba64-33b06339f0cc
Identifies when an ElastiCache security group has been modified or deleted.
Author: Tuan Le (NCSGroup)
· 2022-12-26 · logsource: product=linux category=process_creation · 8a46f16c-8c4c-82d1-b121-0fdd3ba70a84
Detects execution of the "groupdel" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks
Author: Ivan Saakov
· 2024-12-19 · logsource: product=aws service=cloudtrail · ccd6a6c8-bb4e-4a91-9d2a-07e632819374
Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.
An attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.