tfMITRE ATT&CK technique

Account Access Removal T1531

Tactic: Impact
Platforms: Linux, macOS, Windows, SaaS, IaaS, Office Suite, ESXi
Version: 1.5
Created: 09 October 2019
Last modified: 24 October 2025
Contributors: Hubert Mank; Arun Seelagan, CISA; Liran Ravich, CardinalOps

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts.[1] Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.[2][3]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesTop 16%

Detection rules84th percentile · 84% of ATT&CK techniques have this many detection rules written or fewer.

Account Access Removal MITRE reference T1531

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

AkiraG1024 ↗

Deletes administrator accounts in victim networks prior to encryption.1

created 2024-02-201 referenceaka GOLD SAHARA

LAPSUS$G1004 ↗

Has removed a targeted organization's global admin accounts to lock the organization out of all access.1

created 2022-06-091 referenceaka DEV-0537

All 2 groups for this technique

4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.

DEADWOODS1134 ↗

Changes the password for local and domain users via net.exe to a random 32 character string to prevent these accounts from logging on. Additionally, DEADWOOD will terminate the winlogon.exe process to prevent attempts to log on to the infected system.1

created 2024-05-22MALWAREcarried by 2 groups

MeteorS0688 ↗

Has the ability to change the password of local users on compromised hosts and can log off users.1

created 2022-03-07MALWARE

MegaCortexS0576 ↗

Has changed user account passwords and logged users off the system.1

created 2021-02-17MALWARE

LockerGogaS0372 ↗

Has been observed changing account passwords and logging off current users.1 2

created 2019-04-16MALWAREcarried by 1 group

All 4 software entries for this technique

Offense vs defense T1531

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 9Splunk ESCU (cumulative) · 6

first rule: 2021 Q2

Account Access Removal detection strategy DET0120

MITRE names one behaviour worth catching for this technique and breaks it into 6 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Account Access Removal via Multi-Platform Audit Correlation

Enterprise

6 platforms

AN0334 · Windows

Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	WinEventLog:Security	EventCode=4723, 4724, 4740
Process CreationDC0032	WinEventLog:Sysmon	EventCode=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UserContext	Account performing the operation (e.g., Domain Admins vs. local users)
TimeWindow	Alert only on actions outside of maintenance windows
ParentProcessName	Detect suspicious process lineage (e.g., powershell.exe launching net.exe)

AN0335 · Linux

Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	NSM:Connections	Accepted password or publickey for user from remote IP
Process CreationDC0032	auditd:SYSCALL	SYSCALL record where exe contains passwd/userdel/chage and auid != root

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
ExecPath	Binary path for passwd or userdel, which may vary by distro
NonRootUIDThreshold	Alert only if auid != root or expected service account

AN0336 · macOS

Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	macos:unifiedlog	successful sudo or authentication for account not normally associated with admin actions
Command ExecutionDC0064	macos:unifiedlog	command includes dscl . delete or sysadminctl --deleteUser

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
CommandLinePattern	Allow variation in dscl/sysadminctl command structure
AnomalousUserFlag	Detect new or rarely seen users performing user removal

AN0337 · ESXi

Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	esxi:vpxa	user login from unexpected IP or non-admin user role
User Account DeletionDC0009	esxi:hostd	method=RemoveUser or esxcli system account remove invocation

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RemoteUserRole	ESXi role triggering the change (e.g., Administrator vs. Viewer)
ExpectedIPs	IP ranges authorized to conduct admin-level actions

AN0338 · Office Suite

O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account AuthenticationDC0002	m365:signinlogs	Sign-in from anomalous location or impossible travel condition
User Account DeletionDC0009	m365:unified	Remove-Mailbox, Set-Mailbox

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
RoleAssignment	Determine if operation was delegated to expected admin group
GeoThreshold	Trigger on unusual geographic login sources

AN0339 · SaaS

Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account ModificationDC0010	saas:okta	user.lifecycle.delete, user.account.lock

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
BulkActionThreshold	Trigger if multiple deletions occur within a short period
SessionDeviceType	Alert on deletions initiated from unfamiliar device contexts

Tests8ExecutorsPowerShell 3 · sh 3 · cmd 2Need elevation5 of 8Have prerequisites3Have cleanup5Platformswindows, macos, linux, azure-ad

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Change User Password - Windows

windows

cmd

Required

—

Yes

Changes the user password to hinder access attempts. Seen in use by LockerGoga. Upon execution, log into the user account "AtomicAdministrator" with the password "HuHuHUHoHo283283".

Input arguments

Name	Type	Default	Description
new_password	string	HuHuHUHoHo283283@dJD	New password for the specified account.
user_account	string	AtomicAdministrator	User account whose password will be changed.
new_user_password	string	User2ChangePW!	Password to use if user account must be created first

Attack command

net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} #{new_password}

Cleanup command

net.exe user #{user_account} /delete >nul 2>&1

GUID117146c1-97db-4f03-82bc-db1e2db26477

Delete User - Windows

windows

cmd

Required

—

Deletes a user account to prevent access. Upon execution, run the command "net user" to verify that the new "AtomicUser" account was deleted.

Input arguments

Name	Type	Default	Description
user_account	string	AtomicUser	User account to be deleted.
new_user_password	string	User2DeletePW!	Password to use if user account must be created first

Attack command

net user #{user_account} #{new_user_password} /add
net.exe user #{user_account} /delete

GUIDca980e79-3d04-49b5-a364-8358e316478e

Remove Account From Domain Admin Group

windows

PowerShell

—

This test will remove an account from the domain admins group

Input arguments

Name	Type	Default	Description
super_pass	string	password	super_user account password.
super_user	string	domain\super_user	Account used to run the execution command (must include domain).
remove_user	string	remove_user	Account to remove from domain admins.

Attack command

$PWord = ConvertTo-SecureString -String #{super_pass} -AsPlainText -Force
$Credential = New-Object -TypeName System.Management.Automation.PSCredential -ArgumentList #{super_user}, $PWord
if((Get-ADUser #{remove_user} -Properties memberof).memberof -like "CN=Domain Admins*"){
  Remove-ADGroupMember -Identity "Domain Admins" -Members #{remove_user} -Credential $Credential -Confirm:$False
} else{
    write-host "Error - Make sure #{remove_user} is in the domain admins group" -foregroundcolor Red
}

Prerequisite

Requires the Active Directory module for powershell to be installed.

Check

if(Get-Module -ListAvailable -Name ActiveDirectory) {exit 0} else {exit 1}

Satisfy

Add-WindowsCapability -Online -Name "Rsat.ActiveDirectory.DS-LDS.Tools~~~~0.0.1.0"

GUID9c250c14-576e-4f05-a074-7a211721448b

Change User Password via passwd

macos, linux

Required

—

This test changes the user password to hinder access to the account using passwd utility.

Input arguments

Name	Type	Default	Description
user_account	string	ARTUser	User account whose password will be changed.

Attack command

passwd #{user_account} #enter admin password > enter new password > confirm new password

GUID5cdb2e87-d1ca-420c-81b5-253788035ba4

Delete User via dscl utility

macos

Required

—

Yes

This test deletes the user account using the dscl utility.

Input arguments

Name	Type	Default	Description
user_account	string	ARTUser	User account which will be deleted.
user_password	string	ARTPassword	User password.

Attack command

dscl . -delete /Users/#{user_account} #enter admin password

Cleanup command

dscl . -create /Users/#{user_account} #enter admin password
dscl . -create /Users/#{user_account} UserShell /bin/bash
dscl . -create /Users/#{user_account} UniqueID 503
dscl . -create /Users/#{user_account} NFSHomeDirectory /Users/#{user_account}
dscl . -passwd /Users/#{user_account} #{user_password} #enter password for new user

GUIDcac29673-e213-4ddc-a2bb-a018bd280a75

Delete User via sysadminctl utility

macos

Required

—

Yes

This test deletes the user account using the sysadminctl utility.

Input arguments

Name	Type	Default	Description
user_name	string	ARTUser	New user name.
user_account	string	ARTUserAccount	User account which will be deleted.
user_password	string	ARTPassword	New user password.

Attack command

sysadminctl -deleteUser #{user_account} #enter admin password

Cleanup command

sysadminctl -addUser #{user_account} -fullName "#{user_name}" -password #{user_password}

GUID6f5b8241-bda0-47b1-a28e-87c75d0e7f5d

Azure AD - Delete user via Azure AD PowerShell

azure-ad

PowerShell

—

Yes

Deletes a user in Azure AD. Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (excluding changed credentials) to remove access to accounts.

Input arguments

Name	Type	Default	Description
userprincipalname	string	atomicredteam@yourdomain.com	User principal name (UPN) for the Azure user being deleted

Attack command

Connect-AzureAD
$userprincipalname = "#{userprincipalname}"
Remove-AzureADUser -ObjectId $userprincipalname

Cleanup command

N/A

Prerequisite

Check if AzureAD PowerShell module is installed

Check

Get-InstalledModule -Name AzureAD

Satisfy

echo "use the following to install AzureAD PowerShell module - Install-Module -Name AzureAD -Scope CurrentUser -Repository PSGallery -Force"

Prerequisite

Check if AzureAD PowerShell module is installed

Check

Update the input arguments so the userprincipalname value is accurate for your environment

Satisfy

echo "Update the input arguments in the .yaml file so that the userprincipalname value is accurate for your environment"

GUID79d1a76b-67e9-430b-a64b-3a00040acbf7

Azure AD - Delete user via Azure CLI

azure-ad

PowerShell

—

Yes

Input arguments

Name	Type	Default	Description
userprincipalname	string	atomicredteam@yourdomain.com	User principal name (UPN) for the Azure user being deleted

Attack command

az login
$userprincipalname = "#{userprincipalname}"
az ad user delete --id $userprincipalname

Cleanup command

N/A

Prerequisite

Check if Azure CLI is installed and install manually

Check

az account list

Satisfy

echo "use the following to install the Azure CLI manually https://aka.ms/installazurecliwindows"

Prerequisite

Check if Azure CLI is installed and install via PowerShell

Check

az account list

Satisfy

echo "use the following to install the Azure CLI $ProgressPreference = 'SilentlyContinue'; Invoke-WebRequest -Uri https://aka.ms/installazurecliwindows -OutFile .\AzureCLI.msi; Start-Process msiexec.exe -Wait -ArgumentList '/I AzureCLI.msi /quiet'; Remove-Item .\AzureCLI.msi"

Prerequisite

Update the userprincipalname to meet your requirements

Check

Update the input arguments so the userprincipalname value is accurate for your environment

Satisfy

echo "Update the input arguments in the .yaml file so that the userprincipalname value is accurate for your environment"

GUID9f339a7d-3895-4163-8cdd-f6895995a773

Tests from Atomic Red Team (MIT licence) · technique definition

Account Access Removal detections T1531

15 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

Top 16%of all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs