Account Access Removal T1531

Tactic: Impact

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a System Shutdown/Reboot to set malicious changes into place.

Events covered

8 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 62 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (71 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventType14eq 10, wildcard 4DELETE, DELETE_ROLE, DeactivateMFADevice, DeleteGroup, ENFORCE_STRONG_AUTHENTICATION
data_stream.dataset9eq 9gcp.audit, aws.cloudtrail, google_workspace.admin, okta.system
event.outcome7eq 7success
action6eq 5, in 1RevokeUserSessions, create, delete, organization_deleted, role_change_to_user
CommandLine4contains 2, regex_match 2(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+, user, /active:no, /delete
EventID4eq 44104, 4688, storage.hmacKeys.delete
EventMessage4eq 4Permission scheme updated, Project roles changed, User removed from group, User removed from project
Provider_Name4eq 4admin, iam.amazonaws.com
aws::eventName4eq 3, in 1AuthorizeCacheSecurityGroupEgress, AuthorizeCacheSecurityGroupIngress, DeleteCacheSecurityGroup, DeleteDBCluster, DeleteDBInstance
aws::eventSource4eq 4iam.amazonaws.com, elasticache.amazonaws.com, rds.amazonaws.com
process_name4eq 4net1.exe, logoff.exe
OriginalFileName3eq 3net1.exe
event.category3eq 2, in 1iam, ADMINISTRATOR_MANAGEMENT, ROLE_MANAGEMENT
event.dataset3eq 3github.audit
AADOperationType2in 2Assign, AssignEligibleRole, RemoveEligibleRole

Top indicator values (150 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.outcomeeq
success
7251
data_stream.dataseteq
gcp.audit
423
data_stream.dataseteq
aws.cloudtrail
2141
data_stream.dataseteq
google_workspace.admin
218
OriginalFileNameeq
net1.exe
344
event.dataseteq
github.audit
314
process_nameeq
net1.exe
335
AADOperationTypein
Assign
26
AADOperationTypein
AssignEligibleRole
25
AADOperationTypein
RemoveEligibleRole
22
AADOperationTypein
Unassign
22
AddedGlobalAdminTimelt
RemovedGlobalAdminTime
22
Categoryeq
RoleManagement
217
CommandLinecontains
user
217
CommandLineregex_match
(?i)net1?(\.exe)?\s+user\s+\S+\s+\S+
22
DeletedUsersgt
10
22
EventIDeq
4104
2268
Initiatorne
MS-PIM
24
Initiatorne
MS-PIM-Fairfax
24
NoofAdminsRemovedgt
1
22
Provider_Nameeq
admin
29
Provider_Nameeq
iam.amazonaws.com
225
Resulteq
success
225
RoleNameeq
Global Administrator
22
aws::eventSourceeq
iam.amazonaws.com
228
azure_ad::activity_display_namecontains
add eligible member to role
26
azure_ad::activity_display_namecontains
add member to role
26
azure_ad::activity_display_namecontains
remove eligible member from role
22
azure_ad::activity_display_namecontains
remove member from role
22
event.categoryeq
iam
214

Exclusions (28 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
CommandLineregex_match
(?i)\/\S+
2
Imagein
/bin/dockerd
1
Imagein
/usr/bin/containerd
1
Imagein
/usr/bin/dockerd
1
Imagein
/usr/bin/google_guest_agent
1
Imagestarts_with
/nix/store/
1
TargetFilenamecontains
ansible
1
TargetFilenamecontains
backup
1
TargetFilenamecontains
puppet
1
TargetUserNamewildcard
*$
1
TargetUserNamewildcard
*-*-*
1
TargetUserNamewildcard
PIM_*
1
TargetUserNamewildcard
_*_
1
TargetUserNamewildcard
svc*
1
requestParams.pathcontains
/delta-commit
1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 10 rules

Elastic 15 rules

Splunk 8 rules

Kusto 13 rules

YARA-L 1 rule

Panther 15 rules