T1531 — Account Access Removal
Tactic: Impact · Platforms: Linux, macOS, Windows, SaaS, IaaS, Office Suite, ESXi
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.…
Sigma detection rules (6)
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 363fe5f0-2c2e-4777-b6cc-01158d0b628a
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Retargeted to Sysmon EventID matching process_creation telemetry for reliable field coverage.) Tune using: UserContext, TimeWindow, ParentProcessName.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-05-16
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
category: process_creation
product: windows
service: sysmon
detection:
selection:
Image|endswith:
- '\net.exe'
- '\net1.exe'
CommandLine|contains|all:
- 'user'
- '/active:no'
condition: selection
falsepositives:
- Legitimate IT account-deactivation during offboarding; verify against a change ticket.
level: high
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 5532c1f4-4e26-47d4-adcf-00058da9196a
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Detects passwd/usermod lock flags (-l/--lock) and usermod account-expiration abuse via --expiredate 1 or -e 1 (immediate expiry), replacing a prior overly-broad bare "1" match that fired on any argument containing that digit. Tune using: ExecPath, NonRootUIDThreshold.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-06-17
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
category: process_creation
product: linux
detection:
selection_lock:
type: EXECVE
a0|endswith:
- '/passwd'
- '/usermod'
a1:
- '-l'
- '--lock'
selection_expire:
type: EXECVE
a0|endswith: '/usermod'
a1:
- '--expiredate'
- '-e'
a2: '1'
condition: 1 of selection*
falsepositives:
- Legitimate offboarding/account-lockout workflows by IT; scope NonRootUIDThreshold to flag when the acting user is NOT a recognized admin account.
level: high
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 630ec60c-3118-421b-b108-28dd0dd2b5f5
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CommandLinePattern, AnomalousUserFlag.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-01-14
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
product: macos
detection:
selection:
Image|endswith:
- '/dscl'
- '/sysadminctl'
selection_args:
CommandLine|contains:
- '-passwd'
- '-deleteUser'
- '-disableUser'
condition: selection and selection_args
falsepositives:
- Legitimate IT offboarding scripts and account lifecycle automation use the same dscl and sysadminctl commands to disable or remove accounts, so this should be correlated with whether the invoking account is an approved administrator performing a scheduled offboarding action.
level: high
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 6b3c31a0-8b0d-4354-97ff-a85e5e2aa14f
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Data Component: User Account Modification; baseline tier: fallback.) Tune using: BulkActionThreshold, SessionDeviceType.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-02-12
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
product: saas
service: okta
detection:
selection:
eventType: 'user.lifecycle.deactivate'
condition: selection
falsepositives:
- Routine offboarding of departing employees processed through the standard HR-driven deactivation workflow; confirming a bulk malicious wipe requires counting deactivations per actor over a short window, which needs aggregation beyond this rule.
level: high
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 2b947da7-a9d6-4b93-affb-dca5d60618c9
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Data Component: User Account Deletion; baseline tier: fallback.) Tune using: RoleAssignment, GeoThreshold.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-05-22
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
product: m365
service: unified
detection:
selection:
Operation:
- 'Delete user'
- 'Blocked user account'
- 'Delete Group'
- 'Remove member from group'
filter_helpdesk:
Workload: 'SecurityComplianceCenter'
condition: selection and not filter_helpdesk
falsepositives:
- Routine offboarding of departing employees performed by HR-driven identity lifecycle automation.
level: high
T1531 Account Access Removal
title: T1531 Account Access Removal
id: 7faed9fb-29d1-48eb-94b4-9586056535af
description: 'Account Access Removal via Multi-Platform Audit Correlation. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: RemoteUserRole, ExpectedIPs.'
references:
- https://attack.mitre.org/techniques/T1531
author: Shahrukh Khan
date: 2026-05-20
license: MIT
tags:
- attack.impact
- attack.t1531
logsource:
product: esxi
service: shell
detection:
selection:
CommandLine|contains:
- 'esxcli system account remove'
- 'esxcli system permission set'
condition: selection
falsepositives:
- Legitimate offboarding of a local account or intentional permission revocation by an authorized administrator; check RemoteUserRole and ExpectedIPs to rule out an attacker locking out defenders after gaining access.
level: high
Explore