T1531

Account Access Removal

Impact Last updated:

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (changed credentials, revoked permissions) to remove access. In Windows, the Net utility, Set-LocalUser, and Set-ADAccountPassword PowerShell cmdlets may be used to modify user accounts. In Linux, the passwd utility may be used to change passwords. Ransomware families such as LockerGoga, MegaCortex, and Akira use this technique to impede incident response before completing their encryption objective. LAPSUS$ has removed global admin accounts to lock organizations out of all access.

What is T1531 Account Access Removal?

Account Access Removal (T1531) maps to the Impact tactic — the adversary is trying to manipulate, interrupt, or destroy your systems and data in MITRE ATT&CK.

This page provides production-ready detection logic for Account Access Removal, covering the data sources and telemetry it touches: User Account: User Account Deletion, User Account: User Account Modification, User Account: User Account Authentication, Process: Process Creation, Command: Command Execution, Windows Security Event Log, Microsoft Defender for Endpoint. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Impact
Technique
T1531 Account Access Removal
Canonical reference
https://attack.mitre.org/techniques/T1531/
Microsoft Sentinel / Defender
kusto 
let SuspiciousAccountOps = dynamic(["net user", "net.exe user", "Set-LocalUser", "Set-ADAccountPassword", "Disable-ADAccount", "Remove-ADUser", "Remove-LocalUser"]);
// Branch 1: Security Event Log — account deletion, password reset, account disable
let SecurityEventAlerts = SecurityEvent
| where TimeGenerated > ago(24h)
| where EventID in (4723, 4724, 4725, 4726, 4740)
| extend ActionType = case(
    EventID == 4723, "PasswordChangeAttempt",
    EventID == 4724, "PasswordResetAttempt",
    EventID == 4725, "AccountDisabled",
    EventID == 4726, "AccountDeleted",
    EventID == 4740, "AccountLockedOut",
    "Unknown"
)
| extend RiskScore = case(
    EventID == 4726, 90,
    EventID == 4725, 70,
    EventID == 4724, 60,
    EventID == 4723, 40,
    EventID == 4740, 30,
    10
)
| project TimeGenerated, Computer, SubjectUserName, SubjectDomainName, TargetUserName, TargetDomainName, EventID, ActionType, RiskScore, Activity
| where TargetUserName !endswith "$"
| sort by TimeGenerated desc;
// Branch 2: Process events — command-line based account manipulation
let ProcessAlerts = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any (SuspiciousAccountOps)
| extend IsNetUserDelete = ProcessCommandLine has "net user" and (ProcessCommandLine has "/delete" or ProcessCommandLine has "/del")
| extend IsNetUserPasswordChange = ProcessCommandLine has "net user" and not (ProcessCommandLine has "/delete" or ProcessCommandLine has "/del" or ProcessCommandLine has "/domain" or ProcessCommandLine has "/add")
| extend IsPowerShellAccountMod = ProcessCommandLine has_any ("Set-LocalUser", "Set-ADAccountPassword", "Disable-ADAccount", "Remove-ADUser", "Remove-LocalUser")
| extend IsLinuxPasswd = FileName =~ "passwd" and ProcessCommandLine !has "--status"
| extend RiskScore = case(
    IsNetUserDelete, 90,
    IsPowerShellAccountMod, 75,
    IsNetUserPasswordChange, 65,
    IsLinuxPasswd, 50,
    40
)
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine, IsNetUserDelete, IsNetUserPasswordChange, IsPowerShellAccountMod, RiskScore
| sort by Timestamp desc;
// Branch 3: Bulk account operations — high risk signal
let BulkAccountOps = SecurityEvent
| where TimeGenerated > ago(1h)
| where EventID in (4725, 4726)
| summarize OperationCount = count(), AffectedAccounts = make_set(TargetUserName), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated) by Computer, SubjectUserName
| where OperationCount >= 3
| extend AlertType = "BulkAccountRemoval", RiskScore = 100;
SecurityEventAlerts
| union (ProcessAlerts | project TimeGenerated=Timestamp, Computer=DeviceName, SubjectUserName=AccountName, SubjectDomainName="", TargetUserName="", TargetDomainName="", EventID=0, ActionType="ProcessBasedAccountOp", RiskScore, Activity=ProcessCommandLine)
| union (BulkAccountOps | project TimeGenerated=FirstSeen, Computer, SubjectUserName, SubjectDomainName="", TargetUserName=tostring(AffectedAccounts), TargetDomainName="", EventID=0, ActionType=AlertType, RiskScore, Activity=tostring(OperationCount))
| sort by RiskScore desc, TimeGenerated desc

Detects account access removal across three complementary signals: (1) Windows Security Event Log events 4723/4724/4725/4726/4740 for direct account manipulation activity including password changes, resets, disablement, deletion, and lockout; (2) DeviceProcessEvents for command-line invocations of net user /delete, Set-LocalUser, Set-ADAccountPassword, Remove-ADUser, and similar account manipulation commands; (3) bulk account operations — three or more account disables or deletions within one hour from the same subject user, a strong ransomware precursor indicator. Each event is assigned a risk score based on severity, with bulk operations scoring 100.

high severity high confidence

Data Sources

User Account: User Account Deletion User Account: User Account Modification User Account: User Account Authentication Process: Process Creation Command: Command Execution Windows Security Event Log Microsoft Defender for Endpoint

Required Tables

SecurityEvent DeviceProcessEvents

False Positives

  • IT help desk staff routinely resetting user passwords (Event ID 4724) during service desk ticket resolution — correlate with ticketing system activity
  • Automated account provisioning/deprovisioning via IAM tools (SailPoint, CyberArk, BeyondTrust) generating bulk account disable/delete events during employee offboarding cycles
  • Active Directory cleanup scripts run by domain admins to remove stale or orphaned computer and service accounts
  • Password policy enforcement tools forcing password resets at expiry, generating high volumes of 4723/4724 events
  • Security testing or red team exercises simulating ransomware precursor behavior in lab environments

Sigma rule & cross-platform mapping

The detection logic for Account Access Removal (T1531) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1531 Sigma rules on detection.fyi

Platform-specific guides for T1531

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-20 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Delete Local Windows User Account via Net Command

    Expected signal: Security Event ID 4726 (A user account was deleted) with SubjectUserName=current admin account and TargetUserName=df00techtest. Sysmon Event ID 1 for net.exe and net1.exe with CommandLine containing 'user df00techtest /delete'. Security Event ID 4720 (account created) for the creation step.

  2. Test 2Disable Local User Account via PowerShell Set-LocalUser

    Expected signal: Security Event ID 4725 (A user account was disabled) with TargetUserName=df00techtest2. Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Set-LocalUser' and '-Enabled $false'. PowerShell ScriptBlock Log Event ID 4104 with the full Set-LocalUser command.

  3. Test 3Bulk Account Password Change Simulation via Net Command

    Expected signal: Security Event ID 4723 (password change attempt) and/or 4724 (password reset) for df00techtest3. Sysmon Event ID 1 for net.exe with CommandLine containing 'user df00techtest3 NewL0ckedP@ssw0rd!'. The password value itself will appear in process creation logs if command line auditing is enabled.

  4. Test 4Linux Account Lock via passwd -l

    Expected signal: Linux auditd records: syscall=execve for useradd and passwd commands with argv showing '-l df00techtest_linux'. Syslog entries in /var/log/auth.log or /var/log/secure: 'passwd: password changed for df00techtest_linux'. If auditd is configured with USER_MGMT rules, generates AUDIT_USER_MGMT events for account modification.

Response Playbook

Triage

  1. Identify the subject account performing the operation — is this an IT admin, service account, privileged user, or a standard user account that would not normally perform account modifications?
  2. Examine the scope: how many accounts were affected and over what time window? Three or more account deletions or disablements within one hour is a ransomware precursor indicator requiring immediate escalation
  3. Review the specific action taken — password changes (4723/4724) are lower risk than account deletions (4726) or bulk disablements (4725). Deletion of admin accounts specifically mirrors LAPSUS$ and Akira TTPs
  4. Check the initiating process for process-based detections: was the command issued interactively (cmd.exe/PowerShell parent), via a remote session (mstsc.exe, psexec.exe, wmi), or from a service/scheduled task? Remote or service-spawned account manipulation without a change ticket is high suspicion
  5. Look for temporal proximity to other impact techniques: was this preceded or followed by Volume Shadow Copy deletion (vssadmin, wmic shadowcopy delete), encryption activity, or service stop commands? Ransomware attack chains frequently combine T1531 + T1490 + T1489 + T1486 in sequence
  6. Check the targeted account's role and privilege level — deletion or disablement of domain admin, global admin (Azure AD/Entra ID), backup operator, or IT staff accounts indicates deliberate lockout strategy to prevent incident response
  7. Correlate with authentication logs — did the subject account authenticate from an unusual IP, geolocation, or at an unusual time prior to performing account modifications?

Containment

  1. If bulk account removal is confirmed as malicious: immediately isolate the source endpoint from the network using EDR isolation to prevent further lateral movement or additional account modifications
  2. Re-enable or restore all disabled/deleted accounts — on-prem: use Active Directory Users and Computers or `net user <username> /active:yes`; for Azure AD/Entra ID: use Microsoft 365 admin center or `Restore-MgDeletedDirectoryObject`; restore deleted accounts from AD Recycle Bin within the tombstone lifetime
  3. If passwords were changed by the adversary: force password resets for all affected accounts and all accounts that may have been accessible from the compromised endpoint (same subnet, shared credentials)
  4. Revoke all active sessions for the compromised subject account: Azure AD — revoke refresh tokens via `Revoke-MgUserSignInSession`; on-prem — reset Kerberos ticket-granting tickets by resetting the account password twice
  5. Preserve all account modification events before any remediation that might overwrite them — export relevant Security Event Log entries (4723-4726, 4740) and forward to SIEM if not already streaming
  6. Block the compromised account from being used for further actions while investigation is ongoing — disable the account temporarily rather than deleting it to preserve audit trails

Evidence Collection

  1. Windows Security Event Log — Event IDs 4723 (password change attempt), 4724 (password reset), 4725 (account disabled), 4726 (account deleted), 4740 (account locked out): collect from affected DCs and member servers, covering at minimum 48 hours prior to detection
  2. Event ID 4688 (process creation with command line auditing) or Sysmon Event ID 1 — extract all process creation events matching net.exe, powershell.exe, wmic.exe invocations for account operations from the source host
  3. Active Directory audit log — if AD auditing is enabled: `Get-EventLog -LogName Security -InstanceId 4726,4725,4724 -ComputerName <DC>` to capture all account change events from domain controllers
  4. Sysmon Event ID 10 (Process Access) — check for LSASS access from the source process, which may indicate credential dumping preceding the account removal phase
  5. Network logon events (Event ID 4624 Type 3 and 10) for the subject account — trace lateral movement path to identify how the adversary reached the account-manipulation phase
  6. PowerShell ScriptBlock Logging (Event ID 4104) — if Set-ADAccountPassword, Set-LocalUser, or similar cmdlets were used, ScriptBlock logs will capture the full parameter values including new passwords set
  7. Azure AD / Entra ID sign-in logs and audit logs — if the technique involved cloud account manipulation, pull AuditLogs where OperationName contains 'Delete user', 'Disable account', 'Reset user password' for the relevant time window
  8. EDR process tree — export the full parent/child process chain for any processes that performed account modifications to understand the full attack chain from initial access to impact

Escalation Criteria

  • ! Three or more accounts deleted or disabled within a 60-minute window from a single source — immediate escalation as active ransomware precursor; do not wait for additional confirmation
  • ! Administrator or global admin accounts targeted for deletion or disablement — this indicates deliberate incident response lockout strategy (LAPSUS$ / Akira TTP); escalate to CISO immediately
  • ! Account modifications performed by a non-IT account, service account, or an account that logged in from an unusual IP or country in the prior 24 hours
  • ! Account removal activity occurring simultaneously with other ransomware precursor indicators: VSS deletion, file encryption, service stop commands, or firewall rule modifications
  • ! Account password changed to a random or extremely long string (as seen with DEADWOOD malware, which sets passwords to random 32-character strings) rendering accounts unrecoverable without domain admin intervention
  • ! Account modifications detected on multiple endpoints simultaneously — indicates scripted or automated attack propagation across the environment, not an isolated incident

Investigation Guide

Forensic Artifacts

  • > Windows Security Event Log (Security.evtx): Event IDs 4723, 4724, 4725, 4726, 4740 with SubjectUserName (who did it), TargetUserName (victim account), and timestamp
  • > Active Directory tombstone — deleted AD objects are retained in the Deleted Objects container for the tombstone lifetime (default 180 days). Recoverable with: `Get-ADObject -Filter {IsDeleted -eq $True} -IncludeDeletedObjects | Restore-ADObject`
  • > Registry: HKLM\SAM\SAM\Domains\Account\Users — local account data including password hashes and account flags (disabled bit); timestamps indicate last modification
  • > PowerShell console history: `$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` on the source endpoint — may contain account manipulation cmdlets
  • > Prefetch files: `C:\Windows\Prefetch\NET.EXE-*.pf` and `NET1.EXE-*.pf` — execution timestamps for net.exe invocations
  • > Sysmon Operational Log: Event ID 1 entries for net.exe, net1.exe, powershell.exe, wmic.exe with full command lines showing account operations
  • > Azure AD Audit Logs (if cloud-targeted): accessible via Azure Portal > Azure Active Directory > Audit logs, filter by Category=UserManagement and ActivityType=Delete/Disable/PasswordReset
  • > Linux: `/var/log/auth.log` or `/var/log/secure` — records passwd, usermod, userdel invocations with calling user and target account; `/etc/shadow` modification timestamp indicates when password last changed

Tuning Guidance

The highest-fidelity signal for malicious account access removal is bulk operations — three or more account deletions or disablements within 60 minutes from a single account. Tune this threshold based on your environment's offboarding volume. For organizations with automated IAM pipelines, identify the service accounts used by HR systems, Active Directory lifecycle tools, or ITSM integrations (e.g., ServiceNow, SailPoint, Okta workflows) and add them to a suppression list. Suppress by SubjectUserName where the account is a known provisioning service account, not by event type. For password reset alerts (Event 4723/4724), the most actionable tuning is to create an allowlist of help desk tier accounts combined with a change ticket correlation — only alert when the subject account is NOT in your known help desk group. For process-based detections, the parent process is the strongest discriminator: net.exe spawned from explorer.exe, cmd.exe without a known admin session, or a service/scheduled task are all higher risk than net.exe spawned from a remote management tool with a known ticket. On Linux, distinguish interactive passwd calls (TTY attached, called by the account owner) from passwd calls made by root or a service process without a TTY — the latter is highly suspicious.

Hunting Queries

Hunt for accounts performing multiple user deletions or disablements, which is a strong indicator of ransomware precursor activity or an insider threat. Groups by subject account to surface single actors affecting multiple users. BurstActivity flag highlights operations concentrated within a 60-minute window — the temporal signature of automated ransomware tooling.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4725, 4726)
| summarize OperationCount=count(), AffectedAccounts=make_set(TargetUserName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Computers=make_set(Computer) by SubjectUserName, SubjectDomainName
| where OperationCount >= 2
| extend TimeWindowMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend BurstActivity = TimeWindowMinutes < 60
| sort by OperationCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4725 OR EventCode=4726)
earliest=-7d
| stats count as OperationCount, values(TargetUserName) as AffectedAccounts, dc(TargetUserName) as UniqueAccounts, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(host) as Computers by SubjectUserName, SubjectDomainName
| where OperationCount >= 2
| eval TimeWindowMinutes=round((LastSeen - FirstSeen) / 60, 1)
| eval BurstActivity=if(TimeWindowMinutes < 60, "YES", "NO")
| sort - OperationCount

Hunt for net.exe invocations targeting user account operations (password changes or deletions) by extracting the targeted username from the command line. This catches cases where the Security Event Log may not have captured the originating process. Excludes /add and /domain operations to reduce noise from legitimate account creation and domain queries.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has "user" and ProcessCommandLine has_any ("/delete", "/del", "*")
| where not (ProcessCommandLine has "/add" or ProcessCommandLine has "/domain" or ProcessCommandLine has "/help")
| extend ExtractedUsername = extract(@"net\s+user\s+(\S+)", 1, tolower(ProcessCommandLine))
| where isnotempty(ExtractedUsername)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ExtractedUsername, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\net.exe" OR Image="*\\net1.exe")
CommandLine="*user*"
NOT (CommandLine="*/add*" OR CommandLine="*/domain*" OR CommandLine="*/help*")
earliest=-7d
| rex field=CommandLine "net\s+user\s+(?P<ExtractedUsername>\S+)"
| where isnotnull(ExtractedUsername)
| table _time, host, User, CommandLine, ExtractedUsername, ParentImage, ParentCommandLine
| sort - _time

Hunt for any account deletions (Event 4726) over the past 7 days, grouped by the subject (actor) performing the deletion. Excludes computer accounts (ending in $) to focus on human account removals. Provides a full inventory of who deleted what and when — useful for baseline review and for rapidly identifying anomalous deletion actors during an active incident response.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4726
| join kind=leftouter (
    SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID in (4688, 4624)
    | project LogonTime=TimeGenerated, LogonComputer=Computer, LogonSubjectUser=SubjectUserName, LogonType=EventID
) on $left.SubjectUserName == $right.LogonSubjectUser and $left.Computer == $right.LogonComputer
| where TargetUserName !endswith "$"
| summarize DeletionCount=count(), DeletedAccounts=make_set(TargetUserName), Computers=make_set(Computer) by SubjectUserName, SubjectDomainName
| where DeletionCount > 0
| sort by DeletionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4726 earliest=-7d
| where NOT match(TargetUserName, "\$$")
| stats count as DeletionCount, values(TargetUserName) as DeletedAccounts, dc(host) as AffectedHosts, values(host) as Computers, earliest(_time) as FirstDeletion, latest(_time) as LastDeletion by SubjectUserName, SubjectDomainName
| sort - DeletionCount
| eval RiskSignal=case(DeletionCount >= 5, "CRITICAL", DeletionCount >= 3, "HIGH", DeletionCount >= 2, "MEDIUM", true(), "LOW")

Atomic Red Team Tests

Test 1 Delete Local Windows User Account via Net Command
windows

Creates a temporary local user account then immediately deletes it using the net user /delete command. This simulates the account deletion pattern used by Akira ransomware and DEADWOOD malware to remove administrator accounts prior to encryption. The sequence of create-then-delete ensures the test generates both a creation baseline event and a deletion alert event.

Command

powershell 
net user df00techtest Password123! /add
net user df00techtest /delete

Cleanup

powershell 
net user df00techtest /delete 2>nul

Expected Telemetry

Security Event ID 4726 (A user account was deleted) with SubjectUserName=current admin account and TargetUserName=df00techtest. Sysmon Event ID 1 for net.exe and net1.exe with CommandLine containing 'user df00techtest /delete'. Security Event ID 4720 (account created) for the creation step.

Expected Detection

Alert fires on SecurityEvent EventID==4726 for the deletion. KQL: RiskScore=90 (AccountDeleted branch). SPL: EventCode==4726, RiskScore=90, DetectionNote='CRITICAL'. Process branch also fires on the net user /delete command line match.

Test 2 Disable Local User Account via PowerShell Set-LocalUser
windows

Creates a temporary local user account and disables it using the Set-LocalUser PowerShell cmdlet with -Enabled $false. This mirrors the Set-LocalUser and Set-ADAccountPassword patterns documented in MITRE ATT&CK for T1531, as well as LockerGoga's use of PowerShell-based account disablement. Requires local administrator privileges.

Command

powershell 
net user df00techtest2 Password123! /add
Set-LocalUser -Name df00techtest2 -Enabled $false

Cleanup

powershell 
net user df00techtest2 /delete 2>nul

Expected Telemetry

Security Event ID 4725 (A user account was disabled) with TargetUserName=df00techtest2. Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Set-LocalUser' and '-Enabled $false'. PowerShell ScriptBlock Log Event ID 4104 with the full Set-LocalUser command.

Expected Detection

Alert fires on SecurityEvent EventID==4725 (RiskScore=70, AccountDisabled). Process branch fires on 'Set-LocalUser' pattern match in DeviceProcessEvents/Sysmon. KQL: IsPowerShellAccountMod=true, RiskScore=75. SPL: IsPSAccountMod=1, RiskScore=75, DetectionNote='HIGH'.

Test 3 Bulk Account Password Change Simulation via Net Command
windows

Changes the password of a temporary user account using net user with a new password, simulating the MegaCortex and LockerGoga TTP of changing account passwords to lock users out of the system. This is a lower-risk variant of the full deletion technique — adversaries often change passwords first, then delete accounts or log users off. Requires local administrator privileges.

Command

powershell 
net user df00techtest3 Password123! /add
net user df00techtest3 NewL0ckedP@ssw0rd!

Cleanup

powershell 
net user df00techtest3 /delete 2>nul

Expected Telemetry

Security Event ID 4723 (password change attempt) and/or 4724 (password reset) for df00techtest3. Sysmon Event ID 1 for net.exe with CommandLine containing 'user df00techtest3 NewL0ckedP@ssw0rd!'. The password value itself will appear in process creation logs if command line auditing is enabled.

Expected Detection

Alert fires on SecurityEvent EventID==4723/4724 (RiskScore=40-60). KQL: IsNetUserPasswordChange=true in process branch. SPL: IsNetUserPasswordChange=1, RiskScore=65. Note: this represents the ransomware pre-encryption phase and should be correlated with other impact indicators for high-confidence alerting.

Test 4 Linux Account Lock via passwd -l
linux

Creates a temporary Linux user and locks the account using passwd -l, which prepends a '!' to the password hash in /etc/shadow, preventing password-based authentication. This simulates Linux-based account access removal, which may be used on compromised Linux servers or in multi-platform ransomware attacks. Requires root or sudo privileges.

Command

bash 
useradd -m df00techtest_linux
passwd -l df00techtest_linux

Cleanup

bash 
userdel -r df00techtest_linux 2>/dev/null

Expected Telemetry

Linux auditd records: syscall=execve for useradd and passwd commands with argv showing '-l df00techtest_linux'. Syslog entries in /var/log/auth.log or /var/log/secure: 'passwd: password changed for df00techtest_linux'. If auditd is configured with USER_MGMT rules, generates AUDIT_USER_MGMT events for account modification.

Expected Detection

SPL syslog/linux_secure branch detects passwd with non-self argument. KQL DeviceProcessEvents branch detects FileName='passwd' with ProcessCommandLine containing '-l'. Alert severity Medium (RiskScore=50, IsLinuxAccountMod indicator). Correlation with useradd + passwd -l in sequence is a stronger signal.

Related Detections

Tactic Hub

TA0040Impact

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Related Techniques

T1486Data Encrypted for ImpactT1490Inhibit System RecoveryT1489Service StopT1485Data DestructionT1078Valid AccountsT1078.002Domain AccountsT1078.004Cloud AccountsT1529System Shutdown/RebootT1098Account ManipulationT1136Create Account

Same Tactic: Impact

Popular Detections