detection.wiki

Account Access Removal T1531

Tactic: Impact

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.

Events covered

8 catalog events are tagged with this technique by at least one rule.

ProviderEventTitle
SysmonEvent ID 1Process creation
Security-AuditingEvent ID 4624An account was successfully logged on.
Security-AuditingEvent ID 4634An account was logged off.
Security-AuditingEvent ID 4647User initiated logoff.
Security-AuditingEvent ID 4688A new process has been created.
Security-AuditingEvent ID 4724An attempt was made to reset an account's password.
PowerShellEvent ID 4104Creating Scriptblock text (MessageNumber of MessageTotal).
Sysmon-for-LinuxEvent ID 1Process Create

Authoring guide

These 67 rules share fields, values, and exclusions.

Fields filtered most (63 distinct)

These fields appear most often in rule filters.

FieldRulesHowSample values
EventType17eq 12, wildcard 4, in 1ALLOW_STRONG_AUTHENTICATION, CloseAccount, DELETE, DELETE_ROLE, DeactivateMFADevice
data_stream.dataset11eq 11aws.cloudtrail, gcp.audit, google_workspace.admin, okta.system
event.outcome9eq 9success
action5eq 4, in 1RevokeUserSessions, create, organization_deleted, role_change_to_user, service_owner_transferred
process_basename5eq 5, in 1, starts_with 1net1.exe, .*, bash, busybox, logoff.exe
CommandLine4contains 2, regex_match 2(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+, *user*, */active:no*, */delete*
EventID4eq 44104, 4688, storage.hmacKeys.delete
EventMessage4eq 4Permission scheme updated, Project roles changed, User removed from group, User removed from project
Provider_Name4eq 3, in 1iam.amazonaws.com, organizations.amazonaws.com, account.amazonaws.com
aws::eventName4eq 3, in 1AuthorizeCacheSecurityGroupEgress, AuthorizeCacheSecurityGroupIngress, DeleteCacheSecurityGroup, DeleteDBCluster, DeleteDBInstance
aws::eventSource4eq 4iam.amazonaws.com, elasticache.amazonaws.com, rds.amazonaws.com
Image3ends_with 2, starts_with 1./*, /boot/*, /dev/shm/*, /groupdel, /userdel
OriginalFileName3eq 3net1.exe
event.dataset3eq 3github.audit
event.type3eq 3, in 1deletion, group, start, user

Top indicator values (199 distinct)

These values appear most often in rule predicates.

FieldKindValueRules (here)Corpus reach
event.outcomeeq
success
7306
event.outcomeeq
success
282
data_stream.dataseteq
aws.cloudtrail
4143
data_stream.dataseteq
gcp.audit
460
data_stream.dataseteq
google_workspace.admin
216
OriginalFileNameeq
net1.exe
339
event.dataseteq
github.audit
35
event.typeeq
deletion
316
process_basenameeq
net1.exe
340
Categoryeq
RoleManagement
217
CommandLinecontains
*user*
215
CommandLineregex_match
(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+
22
DeletedUsersgt
10
22
EventIDeq
4104
2269
Provider_Nameeq
iam.amazonaws.com
224
aws::eventSourceeq
iam.amazonaws.com
222
azure_ad::activity_display_namecontains
Add eligible member to role
29
azure_ad::activity_display_namecontains
Add member to role
29
serviceNameeq
accounts
213
AADOperationTypein
Assign
16
AADOperationTypein
Assign
12
AADOperationTypein
AssignEligibleRole
15
AADOperationTypein
AssignEligibleRole
12
ActionNameeq
admin_delete
1
ActionNameeq
user_delete
1
ActivityTypein
AccountDeactivated
1
ActivityTypein
AccountPurged
1
ActivityTypein
WorkspaceDeleted
1
AnomalyTypegt
0
1
AnomalyTypeis_not_null
1

Exclusions (31 distinct)

These values appear most often in top-level exclusions.

FieldKindValueRules excluding
CommandLineregex_match
(?i)\/\S+
2
Imagein
/bin/dockerd
1
Imagein
/usr/bin/containerd
1
Imagein
/usr/bin/dockerd
1
Imagein
/usr/bin/google_guest_agent
1
Imagestarts_with
/nix/store/*
1
TargetFilenamecontains
*ansible*
1
TargetFilenamecontains
*backup*
1
TargetFilenamecontains
*puppet*
1
TargetFilenamewildcard
/home/*/*/.ssh/*
1
TargetUserNamewildcard
*$
1
TargetUserNamewildcard
*-*-*
1
TargetUserNamewildcard
PIM_*
1
TargetUserNamewildcard
_*_
1
TargetUserNamewildcard
svc*
1

Rules under this technique

These vendors publish rules tagged with this technique.

Platform (all)
Domain (all)

Sigma 10 rules

Elastic 18 rules

Splunk 8 rules

Kusto 15 rules

YARA-L 1 rule

Panther 15 rules