{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1531","id":"T1531","name":"Account Access Removal","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1531","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"cb00b421f2c324824cd9be7066635856f44cbc97a693b7a13d8280bb8529af2a","description":"Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.(Citation: Obsidian Security SaaS Ransomware June 2023) Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)\n\nIn Windows, [Net](https://attack.mitre.org/software/S0039) utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`).\n\nAdversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective. ","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1531","external_id":"T1531"},{"source_name":"CarbonBlack LockerGoga 2019","description":"CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.","url":"https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"},{"source_name":"Unit42 LockerGoga 2019","description":"Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.","url":"https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"},{"source_name":"Obsidian Security SaaS Ransomware June 2023","description":"Obsidian Threat Research Team. (2023, June 6). SaaS Ransomware Observed in the Wild for Sharepoint in Microsoft 365. Retrieved October 5, 2025.","url":"https://web.archive.org/web/20230608061141/https://www.obsidiansecurity.com/blog/saas-ransomware-observed-sharepoint-microsoft-365/"}],"platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[],"telemetry":[{"id":"DC0064","name":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component","category":"Script and command execution","description":"Execution of a command and its interpreter or parent context.","collection_focus":"Collect process command lines and relevant shell/interpreter audit; shell history alone is neither complete nor tamper-resistant.","providers":[{"name":"PowerShell Script Block Logging","scope":"Script content via event 4104 when configured; channel depends on PowerShell edition.","source_id":"powershell"},{"name":"Sysmon process events","scope":"Interpreter launch and parent context, not full script content.","source_id":"sysmon"},{"name":"Linux Audit","scope":"execve-family execution context; shell built-ins need additional instrumentation.","source_id":"linux"}],"configuration":["Enable Script Block Logging through the policy/configuration for the installed edition. Forward Microsoft-Windows-PowerShell/Operational for Windows PowerShell, or PowerShellCore/Operational for PowerShell 7.","Retain script-block ID and fragment ordering alongside process creation. Protect access to collected script text; secrets may be included.","On Linux, use narrowly scoped Audit execution rules for the lab account and supported architectures, and retain joined SYSCALL/EXECVE/PATH records."],"configuration_example":null,"required_fields":["interpreter","command_line","actor_uid","session_id"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Script content and process command lines are different signals. Logging may be partial, fragmented, filtered or disabled; never assume a command line reveals everything executed.","sources":[{"id":"powershell","title":"Microsoft PowerShell logging on Windows","url":"https://learn.microsoft.com/en-us/powershell/module/microsoft.powershell.core/about/about_logging_windows?view=powershell-7.5"},{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"}],"association":"attack_component","anomaly_design":"Per host role and principal: rare interpreters, command argument patterns and parent-child sequences. Normalize scripts carefully; obfuscation, administrative automation and missing command lines change visibility."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0002","name":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component","category":"Identity and SaaS","description":"Authentication attempts and outcomes for a user or workload account.","collection_focus":"Collect successful and failed sign-ins, authentication method, application and conditional-access context; distinguish account validation from session creation.","providers":[{"name":"Microsoft Entra sign-in logs","scope":"Interactive, non-interactive and workload sign-in contexts, subject to tenant features and access.","source_id":"entra"},{"name":"Cloud identity service audit","scope":"Issuer-side credential and administrative events where the service supports them.","source_id":"cloudtrail"},{"name":"Application audit instrumentation","scope":"Application-side use of identities and sessions; design fields without raw tokens.","source_id":"otel"}],"configuration":["Enable/export the required identity sign-in and audit categories from the lab tenant to a protected destination. Document license, role and retention requirements.","Correlate issuance or administrative changes with later sign-ins using non-secret credential IDs, application IDs, user IDs and correlation IDs.","Exclude passwords, bearer tokens, cookies and private keys. Record success, failure, authentication context and application result separately."],"configuration_example":null,"required_fields":["account","application","result","reason","source_ip"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A token creation record is not evidence of token use; a sign-in is not a complete record of every resource access. Some provider-side data is unavailable to the customer.","sources":[{"id":"entra","title":"Microsoft Entra sign-in logs","url":"https://learn.microsoft.com/en-us/entra/identity/monitoring-health/concept-sign-ins"},{"id":"cloudtrail","title":"AWS CloudTrail event categories","url":"https://docs.aws.amazon.com/awscloudtrail/latest/userguide/cloudtrail-events.html"},{"id":"otel","title":"OpenTelemetry log data model","url":"https://opentelemetry.io/docs/specs/otel/logs/data-model/"}],"association":"attack_component","anomaly_design":"Per identity and application: first-seen clients/resources, changes in authentication failures and session patterns, and unusual permission changes. Separate automation, travel, shared egress and identity-provider policy changes."},{"id":"DC0009","name":"User Account Deletion","page":"telemetry/DC0009/","kind":"attack_component","category":"Windows and directory audit","description":"Deletion of a user account and the identity that requested it.","collection_focus":"Enable Audit User Account Management on the responsible Windows host/controller; export equivalent cloud directory audit where applicable.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["actor","target_account","action","result"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0009","collector":"illustrative-lab-collector","observation":{"actor":"lab-admin","target_account":"lab-temp","action":"delete","result":"success"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1531","id":"T1531","name":"Account Access Removal","domain":"enterprise","platforms":["Linux","macOS","Windows","SaaS","IaaS","Office Suite","ESXi"],"environments":["cloud","cloud-hosted-endpoint","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1531","technique_page":"techniques/enterprise/T1531/","page":"detections/enterprise/T1531/","status":"rule_source_available","counts":{"sigma":9,"atlas_basic":1,"atlas_anomaly":0,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"ccd6a6c8-bb4e-4a91-9d2a-07e632819374","title":"AWS SAML Provider Deletion Activity","status":"experimental","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/ccd6a6c8-bb4e-4a91-9d2a-07e632819374.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_delete_saml_provider.yml","author":"Ivan Saakov","kind":"sigma"},{"id":"7c797da2-9cf2-4523-ba64-33b06339f0cc","title":"AWS ElastiCache Security Group Modified or Deleted","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/7c797da2-9cf2-4523-ba64-33b06339f0cc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_elasticache_security_group_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"12d027c3-b48c-4d9d-8bb6-a732200034b2","title":"Azure Kubernetes Service Account Modified or Deleted","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/12d027c3-b48c-4d9d-8bb6-a732200034b2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_kubernetes_service_account_modified_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"13f81a90-a69c-4fab-8f07-b5bb55416a9f","title":"Google Cloud Service Account Disabled or Deleted","status":"test","level":"medium","logsource":{"product":"gcp","service":"gcp.audit"},"data_path":"data/detection-rules/13f81a90-a69c-4fab-8f07-b5bb55416a9f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_service_account_disabled_or_deleted.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a","title":"Okta User Account Locked Out","status":"test","level":"medium","logsource":{"product":"okta","service":"okta"},"data_path":"data/detection-rules/14701da0-4b0f-4ee6-9c95-2ffb4e73bb9a.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/identity/okta/okta_user_account_locked_out.yml","author":"Austin Songer @austinsonger","kind":"sigma"},{"id":"8a46f16c-8c4c-82d1-b121-0fdd3ba70a84","title":"Group Has Been Deleted Via Groupdel","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/8a46f16c-8c4c-82d1-b121-0fdd3ba70a84.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_groupdel.yml","author":"Tuan Le (NCSGroup)","kind":"sigma"},{"id":"08f26069-6f80-474b-8d1f-d971c6fedea0","title":"User Has Been Deleted Via Userdel","status":"test","level":"medium","logsource":{"product":"linux","category":"process_creation"},"data_path":"data/detection-rules/08f26069-6f80-474b-8d1f-d971c6fedea0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_userdel.yml","author":"Tuan Le (NCSGroup)","kind":"sigma"},{"id":"0badd08f-c6a3-4630-90d3-6875cca440be","title":"User Logoff Event","status":"test","level":"informational","logsource":{"service":"security","product":"windows"},"data_path":"data/detection-rules/0badd08f-c6a3-4630-90d3-6875cca440be.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_user_logoff.yml","author":"frack113","kind":"sigma"},{"id":"48a45d45-8112-416b-8a67-46e03a4b2107","title":"Remove Account From Domain Admin Group","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/48a45d45-8112-416b-8a67-46e03a4b2107.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_susp_remove_adgroupmember.yml","author":"frack113","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1531-1","technique_id":"T1531","title":"T1531 Account Access Removal","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#impact","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":191,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L191","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"941061ba69be31fd1c4a10a7461825ae6d9e9776c97729d64b54c2dda95b4889","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(account_disabled_or_deleted OR credential_reset OR role_removed) AND actor NOT_IN approved_identity_admins -> ALERT","log_sources":[{"title":"Identity Provider Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#40-identity-provider-audit-logs"},{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Cloud Identity and Access Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#105-cloud-identity-and-access-management-logs"}]}],"atlas_anomaly":[],"anomaly_types":[],"strategies":[{"id":"DET0120","name":"Account Access Removal via Multi-Platform Audit Correlation","url":"https://attack.mitre.org/detectionstrategies/DET0120","stix_id":"x-mitre-detection-strategy--655a8556-c82d-4148-b52a-7bc48fe7ce20","relationship_id":"relationship--5f0be570-0bb8-4d1a-913c-9fe95e22ea9b","description":"","analytics":[{"id":"AN0334","name":"Analytic 0334","guidance":"Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0334","platforms":["Windows"],"tuning":[{"field":"UserContext","description":"Account performing the operation (e.g., Domain Admins vs. local users)"},{"field":"TimeWindow","description":"Alert only on actions outside of maintenance windows"},{"field":"ParentProcessName","description":"Detect suspicious process lineage (e.g., powershell.exe launching net.exe)"}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"WinEventLog:Security","channel":"EventCode=4723, 4724, 4740","platforms":["Windows"],"analytic_id":"AN0334","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0334","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0334","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0334","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0335","name":"Analytic 0335","guidance":"Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0335","platforms":["Linux"],"tuning":[{"field":"ExecPath","description":"Binary path for passwd or userdel, which may vary by distro"},{"field":"NonRootUIDThreshold","description":"Alert only if auid != root or expected service account"}],"log_sources":[{"component_id":"DC0032","component":"Process Creation","name":"auditd:SYSCALL","channel":"SYSCALL record where exe contains passwd/userdel/chage and auid != root","platforms":["Linux"],"analytic_id":"AN0335","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0335","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"},{"component_id":"DC0002","component":"User Account Authentication","name":"NSM:Connections","channel":"Accepted password or publickey for user from remote IP","platforms":["Linux"],"analytic_id":"AN0335","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0335","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0336","name":"Analytic 0336","guidance":"Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0336","platforms":["macOS"],"tuning":[{"field":"CommandLinePattern","description":"Allow variation in dscl/sysadminctl command structure"},{"field":"AnomalousUserFlag","description":"Detect new or rarely seen users performing user removal"}],"log_sources":[{"component_id":"DC0064","component":"Command Execution","name":"macos:unifiedlog","channel":"command includes dscl . delete or sysadminctl --deleteUser","platforms":["macOS"],"analytic_id":"AN0336","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0336","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0064/"},{"component_id":"DC0002","component":"User Account Authentication","name":"macos:unifiedlog","channel":"successful sudo or authentication for account not normally associated with admin actions","platforms":["macOS"],"analytic_id":"AN0336","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0336","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0337","name":"Analytic 0337","guidance":"Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0337","platforms":["ESXi"],"tuning":[{"field":"RemoteUserRole","description":"ESXi role triggering the change (e.g., Administrator vs. Viewer)"},{"field":"ExpectedIPs","description":"IP ranges authorized to conduct admin-level actions"}],"log_sources":[{"component_id":"DC0009","component":"User Account Deletion","name":"esxi:hostd","channel":"method=RemoveUser or esxcli system account remove invocation","platforms":["ESXi"],"analytic_id":"AN0337","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0337","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0009/"},{"component_id":"DC0002","component":"User Account Authentication","name":"esxi:vpxa","channel":"user login from unexpected IP or non-admin user role","platforms":["ESXi"],"analytic_id":"AN0337","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0337","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0338","name":"Analytic 0338","guidance":"O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0338","platforms":["Office Suite"],"tuning":[{"field":"RoleAssignment","description":"Determine if operation was delegated to expected admin group"},{"field":"GeoThreshold","description":"Trigger on unusual geographic login sources"}],"log_sources":[{"component_id":"DC0009","component":"User Account Deletion","name":"m365:unified","channel":"Remove-Mailbox, Set-Mailbox","platforms":["Office Suite"],"analytic_id":"AN0338","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0338","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0009/"},{"component_id":"DC0002","component":"User Account Authentication","name":"m365:signinlogs","channel":"Sign-in from anomalous location or impossible travel condition","platforms":["Office Suite"],"analytic_id":"AN0338","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0338","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0002/"}]},{"id":"AN0339","name":"Analytic 0339","guidance":"Deletion or disablement of user accounts in SaaS platforms such as Okta, Salesforce, or Zoom, correlated with anomalous administrative session attributes or multiple account-removal actions within a short duration.","url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0339","platforms":["SaaS"],"tuning":[{"field":"BulkActionThreshold","description":"Trigger if multiple account deletion, deactivation, or suspension actions occur within a short period."},{"field":"SessionDeviceType","description":"Alert when account deletion, deactivation, or suspension is initiated from unfamiliar administrative session contexts."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"saas:okta","channel":"user.lifecycle.deactivate, user.lifecycle.suspend, user.lifecycle.delete.initiated, user.lifecycle.delete.completed","platforms":["SaaS"],"analytic_id":"AN0339","source_url":"https://attack.mitre.org/detectionstrategies/DET0120#AN0339","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]}]}],"telemetry_references":[{"id":"DC0064","name":"Command Execution","tag":"Command Execution","page":"telemetry/DC0064/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0002","name":"User Account Authentication","tag":"User Account Authentication","page":"telemetry/DC0002/","kind":"attack_component"},{"id":"DC0009","name":"User Account Deletion","tag":"User Account Deletion","page":"telemetry/DC0009/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[],"software":[{"id":"S0372","name":"LockerGoga","url":"https://attack.mitre.org/software/S0372","kind":"malware","description":"[LockerGoga](https://attack.mitre.org/software/S0372) has been observed changing account passwords and logging off current users.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019)","relationship_id":"relationship--57385cb2-e3ef-4006-b465-a5a48632d02b","references":[{"source_name":"CarbonBlack LockerGoga 2019","description":"CarbonBlack Threat Analysis Unit. (2019, March 22). TAU Threat Intelligence Notification – LockerGoga Ransomware. Retrieved April 16, 2019.","url":"https://www.carbonblack.com/2019/03/22/tau-threat-intelligence-notification-lockergoga-ransomware/"},{"source_name":"Unit42 LockerGoga 2019","description":"Harbison, M. (2019, March 26). Born This Way? Origins of LockerGoga. Retrieved April 16, 2019.","url":"https://unit42.paloaltonetworks.com/born-this-way-origins-of-lockergoga/"}]},{"id":"S0576","name":"MegaCortex","url":"https://attack.mitre.org/software/S0576","kind":"malware","description":"[MegaCortex](https://attack.mitre.org/software/S0576) has changed user account passwords and logged users off the system.(Citation: IBM MegaCortex)","relationship_id":"relationship--46250897-5a79-4401-b965-da8115a60d7f","references":[{"source_name":"IBM MegaCortex","description":"Del Fierro, C. Kessem, L.. (2020, January 8). From Mega to Giga: Cross-Version Comparison of Top MegaCortex Modifications. Retrieved February 15, 2021.","url":"https://securityintelligence.com/posts/from-mega-to-giga-cross-version-comparison-of-top-megacortex-modifications/"}]},{"id":"S0688","name":"Meteor","url":"https://attack.mitre.org/software/S0688","kind":"malware","description":"[Meteor](https://attack.mitre.org/software/S0688) has the ability to change the password of local users on compromised hosts and can log off users.(Citation: Check Point Meteor Aug 2021)","relationship_id":"relationship--9a8901ea-5cb3-431f-9be8-55986ea41448","references":[{"source_name":"Check Point Meteor Aug 2021","description":"Check Point Research Team. (2021, August 14). Indra - Hackers Behind Recent Attacks on Iran. Retrieved February 17, 2022.","url":"https://research.checkpoint.com/2021/indra-hackers-behind-recent-attacks-on-iran/"}]},{"id":"S1134","name":"DEADWOOD","url":"https://attack.mitre.org/software/S1134","kind":"malware","description":"[DEADWOOD](https://attack.mitre.org/software/S1134) changes the password for local and domain users via <code>net.exe</code> to a random 32 character string to prevent these accounts from logging on. Additionally, [DEADWOOD](https://attack.mitre.org/software/S1134) will terminate the <code>winlogon.exe</code> process to prevent attempts to log on to the infected system.(Citation: SentinelOne Agrius 2021)","relationship_id":"relationship--ca8e4853-3214-4073-86ea-ca6cd62c1eff","references":[{"source_name":"SentinelOne Agrius 2021","description":"Amitai Ben & Shushan Ehrlich. (2021, May). From Wiper to Ransomware: The Evolution of Agrius. Retrieved May 21, 2024.","url":"https://assets.sentinelone.com/sentinellabs/evol-agrius"}]}],"actors":[{"id":"G1004","name":"LAPSUS$","url":"https://attack.mitre.org/groups/G1004","kind":"intrusion-set","description":"[LAPSUS$](https://attack.mitre.org/groups/G1004) has removed a targeted organization's global admin accounts to lock the organization out of all access.(Citation: MSTIC DEV-0537 Mar 2022)","relationship_id":"relationship--a2798404-09a6-4882-8226-257fe55f788c","references":[{"source_name":"MSTIC DEV-0537 Mar 2022","description":"MSTIC, DART, M365 Defender. (2022, March 24). DEV-0537 Criminal Actor Targeting Organizations for Data Exfiltration and Destruction. Retrieved May 17, 2022.","url":"https://www.microsoft.com/security/blog/2022/03/22/dev-0537-criminal-actor-targeting-organizations-for-data-exfiltration-and-destruction/"}]},{"id":"G1024","name":"Akira","url":"https://attack.mitre.org/groups/G1024","kind":"intrusion-set","description":"[Akira](https://attack.mitre.org/groups/G1024) deletes administrator accounts in victim networks prior to encryption.(Citation: Secureworks GOLD SAHARA)","relationship_id":"relationship--21247679-6bd8-43dc-921b-530d255d1d6c","references":[{"source_name":"Secureworks GOLD SAHARA","description":"Secureworks. (n.d.). GOLD SAHARA. Retrieved February 20, 2024.","url":"https://www.secureworks.com/research/threat-profiles/gold-sahara"}]}],"mitigations":[],"candidates":[{"id":"1b99ef28-f83c-4ec5-8a08-1a56263a5bb2","name":"Change User Password - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account \"AtomicAdministrator\" with\nthe password \"HuHuHUHoHo283283\".\n","inputs":{"user_account":{"description":"User account whose password will be changed.","type":"string","default":"AtomicAdministrator"},"new_user_password":{"description":"Password to use if user account must be created first","type":"string","default":"User2ChangePW!"},"new_password":{"description":"New password for the specified account.","type":"string","default":"HuHuHUHoHo283283@dJD"}},"dependencies":[],"source_definition_sha256":"aabb676bf4f042b4c6080b3a7739f060b827d0902819b73ffeae8ca583c66633"},{"id":"3c717bf3-2ecc-4d79-8ac8-0bfbf08fbce6","name":"Change User Password via passwd","platforms":["macos","linux"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"This test changes the user password to hinder access to the account using passwd utility.\n","inputs":{"user_account":{"description":"User account whose password will be changed.","type":"string","default":"ARTUser"}},"dependencies":[],"source_definition_sha256":"e0d428a04cd8f26882c345708e1055648b3740ba7cb124e63459eff7e183c5f9"},{"id":"43f71395-6c37-498e-ab17-897d814a0947","name":"Remove Account From Domain Admin Group","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"This test will remove an account from the domain admins group\n","inputs":{"super_user":{"description":"Account used to run the execution command (must include domain).","type":"string","default":"domain\\super_user"},"super_pass":{"description":"super_user account password.","type":"string","default":"password"},"remove_user":{"description":"Account to remove from domain admins.","type":"string","default":"remove_user"}},"dependencies":[{"description":"Requires the Active Directory module for powershell to be installed.\n"}],"source_definition_sha256":"fb14aaf591c2abbfdae9f90e233f2fcbd8b5245f00fe0ccb73dd0712b995b774"},{"id":"4d938c43-2fe8-4d70-a5b3-5bf239aa7846","name":"Delete User via dscl utility","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"This test deletes the user account using the dscl utility.\n","inputs":{"user_account":{"description":"User account which will be deleted.","type":"string","default":"ARTUser"},"user_password":{"description":"User password.","type":"string","default":"ARTPassword"}},"dependencies":[],"source_definition_sha256":"86f62b2cfcde2625810034b0d2c618fcbf511939c7994ddb7945fedaf20b0f36"},{"id":"d3812c4e-30ee-466a-a0aa-07e355b561d6","name":"Delete User via sysadminctl utility","platforms":["macos"],"method":"automated","executor":"sh","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"This test deletes the user account using the sysadminctl utility.\n","inputs":{"user_account":{"description":"User account which will be deleted.","type":"string","default":"ARTUserAccount"},"user_name":{"description":"New user name.","type":"string","default":"ARTUser"},"user_password":{"description":"New user password.","type":"string","default":"ARTPassword"}},"dependencies":[],"source_definition_sha256":"55ef80e08443e6ea31eeaa4cfa402e0915d74f9c38ffead4ef59941e2c353986"},{"id":"f21a1d7d-a62f-442a-8c3a-2440d43b19e5","name":"Delete User - Windows","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1531/T1531.yaml","description":"Deletes a user account to prevent access. Upon execution, run the command \"net user\" to verify that the new \"AtomicUser\" account was deleted.\n","inputs":{"new_user_password":{"description":"Password to use if user account must be created first","type":"string","default":"User2DeletePW!"},"user_account":{"description":"User account to be deleted.","type":"string","default":"AtomicUser"}},"dependencies":[],"source_definition_sha256":"bc7ba2f1c73bfc49d23917b3371a6090d46ed0484f3fa39acc9d9d9dada2fdba"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1529":"/ttp-simulation/techniques/enterprise/T1529/","T1059.001":"/ttp-simulation/techniques/enterprise/T1059.001/","T1485":"/ttp-simulation/techniques/enterprise/T1485/","T1491":"/ttp-simulation/techniques/enterprise/T1491/","T1486":"/ttp-simulation/techniques/enterprise/T1486/","T1531":"/ttp-simulation/techniques/enterprise/T1531/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1531","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0064","collector":"illustrative-lab-collector","observation":{"interpreter":"/bin/sh","command_line":"printf LAB_TELEMETRY_CHECK","actor_uid":1000,"session_id":"lab-session-1"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0002","collector":"illustrative-lab-collector","observation":{"account":"analyst@example.test","application":"lab-portal","result":"failure","reason":"invalid_credential","source_ip":"192.0.2.10"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0009","collector":"illustrative-lab-collector","observation":{"actor":"lab-admin","target_account":"lab-temp","action":"delete","result":"success"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}}]}}