Applied Cybernetics Group
T1531 Account Access Removal
- Technique
T1531- Tactics
- Impact
- Research, 90 days
- 1
- KEV CVEs mapped
- 1
- SigmaHQ rules
- 9
- Elastic, Splunk
- 26
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1531
MITRE description
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.(Citation: Obsidian Security SaaS Ransomware June 2023) Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place.(Citation: CarbonBlack LockerGoga 2019)(Citation: Unit42 LockerGoga 2019) In Windows, [Net](https://attack.mitre.org/software/S0039) utility, <code>Set-LocalUser</code> and <code>Set-ADAccountPassword</code> [PowerShell](https://attack.mitre.org/techniques/T1059/001) cmdlets may be used by adversaries to modify user accounts. Accounts could also be disabled by Group Policy. In Linux, the <code>passwd</code> utility may be used to change passwords. On ESXi servers, accounts can be removed or modified via esxcli (`system account set`, `system account remove`). Adversaries who use ransomware or similar attacks may first perform this and other Impact behaviors, such as [Data Destruction](https://attack.mitre.org/techniques/T1485) and [Defacement](https://attack.mitre.org/techniques/T1491), in order to impede incident response/recovery before completing the [Data Encrypted for Impact](https://attack.mitre.org/techniques/T1486) objective.
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-09-21Kaspersky Securelist: Group Policy hijacked: PAYLOAD ransomware weaponizes Active Directory GPO
Detection coverage
SigmaHQ community rules
- AWS SAML Provider Deletion Activity (core)
- AWS ElastiCache Security Group Modified or Deleted (core)
- Azure Kubernetes Service Account Modified or Deleted (core)
- Google Cloud Service Account Disabled or Deleted (core)
- Okta User Account Locked Out (core)
- Group Has Been Deleted Via Groupdel (core)
- User Has Been Deleted Via Userdel (core)
- User Logoff Event (core)
- Remove Account From Domain Admin Group (core)
Elastic and Splunk rules
- Potential Destructive AWS CLI Command Executed by GenAI Agent (elastic)
- Anthropic Admin API Key Deleted (elastic)
- Anthropic Organization Deletion (elastic)
- AWS Attempt to Leave Organization (elastic)
- AWS Account Closed (elastic)
- AWS IAM Deactivation of MFA Device (elastic)
- AWS IAM Group Deletion (elastic)
- GCP IAM Role Deletion (elastic)
- GCP Service Account Deletion (elastic)
- GCP Service Account Disabled (elastic)
- GCP IAM Service Account Key Deletion (elastic)
- Google Workspace Admin Role Deletion (elastic)
- Google Workspace MFA Enforcement Disabled For Organization (elastic)
- Attempt to Revoke Okta API Token (elastic)
- SSH Authorized Keys File Deletion (elastic)
- Linux User or Group Deletion (elastic)
- Account Password Reset Remotely (elastic)
- Member Removed From GitHub Organization (elastic)
- GitHub PAT Access Revoked (elastic)
- GitHub User Blocked From Organization (elastic)
- Cisco ASA - User Account Deleted From Local Database (splunk)
- Windows Account Access Removal via Logoff Exec (splunk)
- Windows Excessive Usage Of Net App (splunk)
- Windows Powershell Logoff User via Quser (splunk)
- Windows User Deletion Via Net (splunk)
Showing 25 of 26.