{"id":"T1531","name":"Account Access Removal","url":"https://attack.mitre.org/techniques/T1531","tactics":["impact"],"platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0120","stix_id":"x-mitre-detection-strategy--655a8556-c82d-4148-b52a-7bc48fe7ce20","name":"Account Access Removal via Multi-Platform Audit Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0120","analytics":[{"id":"AN0334","stix_id":"x-mitre-analytic--7d0595b9-eca7-488d-bbc2-ed02ff4ced9b","name":"Analytic 0334","description":"Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0334","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4723, 4724, 4740","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"UserContext","description":"Account performing the operation (e.g., Domain Admins vs. local users)"},{"field":"TimeWindow","description":"Alert only on actions outside of maintenance windows"},{"field":"ParentProcessName","description":"Detect suspicious process lineage (e.g., powershell.exe launching net.exe)"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]},{"id":"AN0335","stix_id":"x-mitre-analytic--a941dd04-5626-4091-9eed-300d7d7f0a1f","name":"Analytic 0335","description":"Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0335","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"SYSCALL record where exe contains passwd/userdel/chage and auid != root","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"auditd-syscall"},{"name":"NSM:Connections","channel":"Accepted password or publickey for user from remote IP","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"nsm-connections"}],"mutable_elements":[{"field":"ExecPath","description":"Binary path for passwd or userdel, which may vary by distro"},{"field":"NonRootUIDThreshold","description":"Alert only if auid != root or expected service account"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]},{"id":"AN0336","stix_id":"x-mitre-analytic--adbe8ef2-15e5-4fb9-83d8-4c67b7b1be78","name":"Analytic 0336","description":"Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0336","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"command includes dscl . delete or sysadminctl --deleteUser","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"successful sudo or authentication for account not normally associated with admin actions","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"CommandLinePattern","description":"Allow variation in dscl/sysadminctl command structure"},{"field":"AnomalousUserFlag","description":"Detect new or rarely seen users performing user removal"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]},{"id":"AN0337","stix_id":"x-mitre-analytic--2c5d3103-2b9c-4b56-b415-c01e055fff64","name":"Analytic 0337","description":"Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0337","platforms":["ESXi"],"log_source_references":[{"name":"esxi:hostd","channel":"method=RemoveUser or esxcli system account remove invocation","data_component":"DC0009","data_component_name":"User Account Deletion","log_source_slug":"esxi-hostd"},{"name":"esxi:vpxa","channel":"user login from unexpected IP or non-admin user role","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"esxi-vpxa"}],"mutable_elements":[{"field":"RemoteUserRole","description":"ESXi role triggering the change (e.g., Administrator vs. Viewer)"},{"field":"ExpectedIPs","description":"IP ranges authorized to conduct admin-level actions"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]},{"id":"AN0338","stix_id":"x-mitre-analytic--ba6c8c55-ee38-4219-a426-a3f1e04c7a8a","name":"Analytic 0338","description":"O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0338","platforms":["Office Suite"],"log_source_references":[{"name":"m365:unified","channel":"Remove-Mailbox, Set-Mailbox","data_component":"DC0009","data_component_name":"User Account Deletion","log_source_slug":"m365-unified"},{"name":"m365:signinlogs","channel":"Sign-in from anomalous location or impossible travel condition","data_component":"DC0002","data_component_name":"User Account Authentication","log_source_slug":"m365-signinlogs"}],"mutable_elements":[{"field":"RoleAssignment","description":"Determine if operation was delegated to expected admin group"},{"field":"GeoThreshold","description":"Trigger on unusual geographic login sources"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]},{"id":"AN0339","stix_id":"x-mitre-analytic--af7bff30-45c5-4baf-9ced-68208b7ae836","name":"Analytic 0339","description":"Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0339","platforms":["SaaS"],"log_source_references":[{"name":"saas:okta","channel":"user.lifecycle.delete, user.account.lock","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"saas-okta"}],"mutable_elements":[{"field":"BulkActionThreshold","description":"Trigger if multiple deletions occur within a short period"},{"field":"SessionDeviceType","description":"Alert on deletions initiated from unfamiliar device contexts"}],"live":true,"detection_strategies":["DET0120"],"techniques":["T1531"]}],"live":true,"version":"1.0","techniques":["T1531"]}],"sigma_rules":[{"id":"08f26069-6f80-474b-8d1f-d971c6fedea0","title":"User Has Been Deleted Via Userdel","author":"Tuan Le (NCSGroup)","status":"test","level":"medium","date":"2022-12-26","modified":null,"description":"Detects execution of the \"userdel\" binary. Which is used to delete a user account and related files. This is sometimes abused by threat actors in order to cover their tracks","references":["https://linuxize.com/post/how-to-delete-group-in-linux/","https://www.cyberciti.biz/faq/linux-remove-user-command/","https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/","https://linux.die.net/man/8/userdel"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1531"],"path":"rules/linux/process_creation/proc_creation_lnx_userdel.yml","techniques":["T1531"],"cves":[]},{"id":"0badd08f-c6a3-4630-90d3-6875cca440be","title":"User Logoff Event","author":"frack113","status":"test","level":"informational","date":"2022-10-14","modified":null,"description":"Detects a user log-off activity. Could be used for example to correlate information during forensic investigations","references":["https://github.com/Yamato-Security/EnableWindowsLogSettings/blob/7f6d755d45ac7cc9fc35b0cbf498e6aa4ef19def/ConfiguringSecurityLogAuditPolicies.md","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4634","https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4647"],"logsource":{"product":"windows","service":"security"},"tags":["attack.impact","attack.t1531"],"path":"rules/windows/builtin/security/win_security_user_logoff.yml","techniques":["T1531"],"cves":[]},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-07","modified":"2022-08-23","description":"Identifies when a service account is modified or deleted.","references":["https://learn.microsoft.com/en-us/azure/role-based-access-control/resource-provider-operations#microsoftkubernetes","https://www.microsoft.com/security/blog/2021/03/23/secure-containerized-environments-with-updated-threat-matrix-for-kubernetes/","https://www.microsoft.com/security/blog/2020/04/02/attack-matrix-kubernetes/","https://medium.com/mitre-engenuity/att-ck-for-containers-now-available-4c2359654bf1"],"logsource":{"product":"azure","service":"activitylogs"},"tags":["attack.impact","attack.t1531","attack.t1485","attack.t1496","attack.t1489"],"path":"rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","techniques":["T1531","T1485","T1496","T1489"],"cves":[]},{"id":"13f81a90-a69c-4fab-8f07-b5bb55416a9f","title":"Google Cloud Service Account Disabled or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-08-14","modified":"2022-10-09","description":"Identifies when a service account is disabled or deleted in Google Cloud.","references":["https://cloud.google.com/iam/docs/reference/rest/v1/projects.serviceAccounts"],"logsource":{"product":"gcp","service":"gcp.audit"},"tags":["attack.impact","attack.t1531"],"path":"rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml","techniques":["T1531"],"cves":[]},{"id":"14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a","title":"Okta User Account Locked Out","author":"Austin Songer @austinsonger","status":"test","level":"medium","date":"2021-09-12","modified":"2026-04-27","description":"Detects when an user account is locked out.","references":["https://developer.okta.com/docs/reference/api/system-log/","https://developer.okta.com/docs/reference/api/event-types/"],"logsource":{"product":"okta","service":"okta"},"tags":["attack.impact","attack.t1531"],"path":"rules/identity/okta/okta_user_account_locked_out.yml","techniques":["T1531"],"cves":[]},{"id":"48a45d45-8112-416b-8a67-46e03a4b2107","title":"Remove Account From Domain Admin Group","author":"frack113","status":"test","level":"medium","date":"2021-12-26","modified":null,"description":"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users.\nAccounts may be deleted, locked, or manipulated (ex: changed credentials) to remove access to accounts.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1531/T1531.md#atomic-test-3---remove-account-from-domain-admin-group"],"logsource":{"product":"windows","category":"ps_script"},"tags":["attack.impact","attack.t1531"],"path":"rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml","techniques":["T1531"],"cves":[]},{"id":"7c797da2-9cf2-4523-ba64-33b06339f0cc","title":"AWS ElastiCache Security Group Modified or Deleted","author":"Austin Songer @austinsonger","status":"test","level":"low","date":"2021-07-24","modified":"2022-10-09","description":"Identifies when an ElastiCache security group has been modified or deleted.","references":["https://github.com/elastic/detection-rules/blob/7d5efd68603f42be5e125b5a6a503b2ef3ac0f4e/rules/integrations/aws/impact_elasticache_security_group_modified_or_deleted.toml"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.impact","attack.t1531"],"path":"rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml","techniques":["T1531"],"cves":[]},{"id":"8a46f16c-8c4c-82d1-b121-0fdd3ba70a84","title":"Group Has Been Deleted Via Groupdel","author":"Tuan Le (NCSGroup)","status":"test","level":"medium","date":"2022-12-26","modified":null,"description":"Detects execution of the \"groupdel\" binary. Which is used to delete a group. This is sometimes abused by threat actors in order to cover their tracks","references":["https://linuxize.com/post/how-to-delete-group-in-linux/","https://www.cyberciti.biz/faq/linux-remove-user-command/","https://www.cybrary.it/blog/0p3n/linux-commands-used-attackers/","https://linux.die.net/man/8/groupdel"],"logsource":{"product":"linux","category":"process_creation"},"tags":["attack.impact","attack.t1531"],"path":"rules/linux/process_creation/proc_creation_lnx_groupdel.yml","techniques":["T1531"],"cves":[]},{"id":"ccd6a6c8-bb4e-4a91-9d2a-07e632819374","title":"AWS SAML Provider Deletion Activity","author":"Ivan Saakov","status":"experimental","level":"medium","date":"2024-12-19","modified":null,"description":"Detects the deletion of an AWS SAML provider, potentially indicating malicious intent to disrupt administrative or security team access.\nAn attacker can remove the SAML provider for the information security team or a team of system administrators, to make it difficult for them to work and investigate at the time of the attack and after it.\n","references":["https://docs.aws.amazon.com/IAM/latest/APIReference/API_DeleteSAMLProvider.html"],"logsource":{"product":"aws","service":"cloudtrail"},"tags":["attack.stealth","attack.t1078.004","attack.privilege-escalation","attack.initial-access","attack.persistence","attack.t1531","attack.impact"],"path":"rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml","techniques":["T1078.004","T1531"],"cves":[]}],"kev_cves":[{"cveID":"CVE-2023-34362","state":"mapped","mapping_types":["secondary_impact"]}],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}