T1531 Elastic Security · Elastic

Detect Account Access Removal in Elastic Security

Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (changed credentials, revoked permissions) to remove access. In Windows, the Net utility, Set-LocalUser, and Set-ADAccountPassword PowerShell cmdlets may be used to modify user accounts. In Linux, the passwd utility may be used to change passwords. Ransomware families such as LockerGoga, MegaCortex, and Akira use this technique to impede incident response before completing their encryption objective. LAPSUS$ has removed global admin accounts to lock organizations out of all access.

MITRE ATT&CK

Tactic
Impact
Technique
T1531 Account Access Removal
Canonical reference
https://attack.mitre.org/techniques/T1531/

Elastic Detection Query

Elastic Security (Elastic)
eql 
any where
  (
    event.code in ("4723", "4724", "4725", "4726", "4740") and
    winlog.channel : "Security" and
    not winlog.event_data.TargetUserName : "*$"
  ) or
  (
    event.category : "process" and
    event.type : "start" and
    process.command_line : (
      "*net user*/del*", "*net user*/delete*",
      "*Set-LocalUser*", "*Set-ADAccountPassword*",
      "*Disable-ADAccount*", "*Remove-ADUser*",
      "*Remove-LocalUser*", "*userdel *", "*usermod -L*"
    )
  )
high severity high confidence

Detects T1531 Account Access Removal by monitoring Windows Security Event Log account lifecycle events (EventIDs 4723, 4724, 4725, 4726, 4740 — password changes, resets, account disabling, deletion, and lockout) and process-based account manipulation commands via Elastic Endpoint or Sysmon telemetry. Uses ECS field winlog.event_data.TargetUserName with wildcard filter to exclude computer accounts (trailing $) and process.command_line wildcard matching for net user /delete, PowerShell Active Directory cmdlets, and Linux passwd/userdel utilities. Aligns detection fidelity with the KQL/SPL implementation covering both event-log and process-telemetry branches.

Data Sources

Windows Security Event Log (via Winlogbeat or Elastic Agent)Elastic Endpoint process telemetryWindows Sysmon (via Winlogbeat)Linux Auditbeat

Required Tables

winlog-*logs-endpoint.events.process-*logs-system.security-*

False Positives & Tuning

  • IT administrators performing authorized account lifecycle management during employee offboarding, including bulk disable and delete operations for departing employees via Active Directory Users and Computers or RSAT PowerShell modules
  • Automated identity governance and administration platforms such as SailPoint, Saviynt, or Microsoft Identity Governance executing access certification remediations that disable or delete accounts at scale
  • Password expiration enforcement scripts and privileged access management solutions (CyberArk, BeyondTrust, Thycotic) that programmatically reset service account credentials on rotation schedules via Set-ADAccountPassword

Other platforms for T1531

Microsoft Sentinel (KQL) Splunk (SPL) IBM QRadar (QRadar) Sumo Logic CSE (Sumo) Google Chronicle (YARA-L) CrowdStrike LogScale (LogScale) All platforms (combined) →

Testing Methodology

Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1 Delete Local Windows User Account via Net Command

    Expected signal: Security Event ID 4726 (A user account was deleted) with SubjectUserName=current admin account and TargetUserName=df00techtest. Sysmon Event ID 1 for net.exe and net1.exe with CommandLine containing 'user df00techtest /delete'. Security Event ID 4720 (account created) for the creation step.

  2. Test 2 Disable Local User Account via PowerShell Set-LocalUser

    Expected signal: Security Event ID 4725 (A user account was disabled) with TargetUserName=df00techtest2. Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Set-LocalUser' and '-Enabled $false'. PowerShell ScriptBlock Log Event ID 4104 with the full Set-LocalUser command.

  3. Test 3 Bulk Account Password Change Simulation via Net Command

    Expected signal: Security Event ID 4723 (password change attempt) and/or 4724 (password reset) for df00techtest3. Sysmon Event ID 1 for net.exe with CommandLine containing 'user df00techtest3 NewL0ckedP@ssw0rd!'. The password value itself will appear in process creation logs if command line auditing is enabled.

  4. Test 4 Linux Account Lock via passwd -l

    Expected signal: Linux auditd records: syscall=execve for useradd and passwd commands with argv showing '-l df00techtest_linux'. Syslog entries in /var/log/auth.log or /var/log/secure: 'passwd: password changed for df00techtest_linux'. If auditd is configured with USER_MGMT rules, generates AUDIT_USER_MGMT events for account modification.

Last updated: 2026-04-20 Research depth: deep
References (9)

Response Playbook

Triage

  1. Identify the subject account performing the operation — is this an IT admin, service account, privileged user, or a standard user account that would not normally perform account modifications?
  2. Examine the scope: how many accounts were affected and over what time window? Three or more account deletions or disablements within one hour is a ransomware precursor indicator requiring immediate escalation
  3. Review the specific action taken — password changes (4723/4724) are lower risk than account deletions (4726) or bulk disablements (4725). Deletion of admin accounts specifically mirrors LAPSUS$ and Akira TTPs
  4. Check the initiating process for process-based detections: was the command issued interactively (cmd.exe/PowerShell parent), via a remote session (mstsc.exe, psexec.exe, wmi), or from a service/scheduled task? Remote or service-spawned account manipulation without a change ticket is high suspicion
  5. Look for temporal proximity to other impact techniques: was this preceded or followed by Volume Shadow Copy deletion (vssadmin, wmic shadowcopy delete), encryption activity, or service stop commands? Ransomware attack chains frequently combine T1531 + T1490 + T1489 + T1486 in sequence
  6. Check the targeted account's role and privilege level — deletion or disablement of domain admin, global admin (Azure AD/Entra ID), backup operator, or IT staff accounts indicates deliberate lockout strategy to prevent incident response
  7. Correlate with authentication logs — did the subject account authenticate from an unusual IP, geolocation, or at an unusual time prior to performing account modifications?

Containment

  1. If bulk account removal is confirmed as malicious: immediately isolate the source endpoint from the network using EDR isolation to prevent further lateral movement or additional account modifications
  2. Re-enable or restore all disabled/deleted accounts — on-prem: use Active Directory Users and Computers or `net user <username> /active:yes`; for Azure AD/Entra ID: use Microsoft 365 admin center or `Restore-MgDeletedDirectoryObject`; restore deleted accounts from AD Recycle Bin within the tombstone lifetime
  3. If passwords were changed by the adversary: force password resets for all affected accounts and all accounts that may have been accessible from the compromised endpoint (same subnet, shared credentials)
  4. Revoke all active sessions for the compromised subject account: Azure AD — revoke refresh tokens via `Revoke-MgUserSignInSession`; on-prem — reset Kerberos ticket-granting tickets by resetting the account password twice
  5. Preserve all account modification events before any remediation that might overwrite them — export relevant Security Event Log entries (4723-4726, 4740) and forward to SIEM if not already streaming
  6. Block the compromised account from being used for further actions while investigation is ongoing — disable the account temporarily rather than deleting it to preserve audit trails

Evidence Collection

  1. Windows Security Event Log — Event IDs 4723 (password change attempt), 4724 (password reset), 4725 (account disabled), 4726 (account deleted), 4740 (account locked out): collect from affected DCs and member servers, covering at minimum 48 hours prior to detection
  2. Event ID 4688 (process creation with command line auditing) or Sysmon Event ID 1 — extract all process creation events matching net.exe, powershell.exe, wmic.exe invocations for account operations from the source host
  3. Active Directory audit log — if AD auditing is enabled: `Get-EventLog -LogName Security -InstanceId 4726,4725,4724 -ComputerName <DC>` to capture all account change events from domain controllers
  4. Sysmon Event ID 10 (Process Access) — check for LSASS access from the source process, which may indicate credential dumping preceding the account removal phase
  5. Network logon events (Event ID 4624 Type 3 and 10) for the subject account — trace lateral movement path to identify how the adversary reached the account-manipulation phase
  6. PowerShell ScriptBlock Logging (Event ID 4104) — if Set-ADAccountPassword, Set-LocalUser, or similar cmdlets were used, ScriptBlock logs will capture the full parameter values including new passwords set
  7. Azure AD / Entra ID sign-in logs and audit logs — if the technique involved cloud account manipulation, pull AuditLogs where OperationName contains 'Delete user', 'Disable account', 'Reset user password' for the relevant time window
  8. EDR process tree — export the full parent/child process chain for any processes that performed account modifications to understand the full attack chain from initial access to impact

Escalation Criteria

  • !Three or more accounts deleted or disabled within a 60-minute window from a single source — immediate escalation as active ransomware precursor; do not wait for additional confirmation
  • !Administrator or global admin accounts targeted for deletion or disablement — this indicates deliberate incident response lockout strategy (LAPSUS$ / Akira TTP); escalate to CISO immediately
  • !Account modifications performed by a non-IT account, service account, or an account that logged in from an unusual IP or country in the prior 24 hours
  • !Account removal activity occurring simultaneously with other ransomware precursor indicators: VSS deletion, file encryption, service stop commands, or firewall rule modifications
  • !Account password changed to a random or extremely long string (as seen with DEADWOOD malware, which sets passwords to random 32-character strings) rendering accounts unrecoverable without domain admin intervention
  • !Account modifications detected on multiple endpoints simultaneously — indicates scripted or automated attack propagation across the environment, not an isolated incident

Investigation Guide

Related Techniques

T1486 — Data Encrypted for Impact (ransomware final stage that T1531 typically precedes)T1490 — Inhibit System Recovery (VSS deletion frequently co-occurs with account removal in ransomware chains)T1489 — Service Stop (disabling backup and security services alongside account removal)T1485 — Data Destruction (data wiping as part of the same impact phase)T1078 — Valid Accounts (adversary uses valid credentials to perform account manipulation)T1078.002 — Domain Accounts (elevated privileges required to modify AD accounts)T1078.004 — Cloud Accounts (LAPSUS$ removed Azure global admin accounts)T1529 — System Shutdown/Reboot (LockerGoga and MegaCortex log off users and reboot after account changes to enforce new credentials)T1098 — Account Manipulation (credential manipulation broader category)T1136 — Create Account (adversary may create a new backdoor account while removing legitimate ones)

Forensic Artifacts

  • >Windows Security Event Log (Security.evtx): Event IDs 4723, 4724, 4725, 4726, 4740 with SubjectUserName (who did it), TargetUserName (victim account), and timestamp
  • >Active Directory tombstone — deleted AD objects are retained in the Deleted Objects container for the tombstone lifetime (default 180 days). Recoverable with: `Get-ADObject -Filter {IsDeleted -eq $True} -IncludeDeletedObjects | Restore-ADObject`
  • >Registry: HKLM\SAM\SAM\Domains\Account\Users — local account data including password hashes and account flags (disabled bit); timestamps indicate last modification
  • >PowerShell console history: `$env:APPDATA\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt` on the source endpoint — may contain account manipulation cmdlets
  • >Prefetch files: `C:\Windows\Prefetch\NET.EXE-*.pf` and `NET1.EXE-*.pf` — execution timestamps for net.exe invocations
  • >Sysmon Operational Log: Event ID 1 entries for net.exe, net1.exe, powershell.exe, wmic.exe with full command lines showing account operations
  • >Azure AD Audit Logs (if cloud-targeted): accessible via Azure Portal > Azure Active Directory > Audit logs, filter by Category=UserManagement and ActivityType=Delete/Disable/PasswordReset
  • >Linux: `/var/log/auth.log` or `/var/log/secure` — records passwd, usermod, userdel invocations with calling user and target account; `/etc/shadow` modification timestamp indicates when password last changed

Tuning Guidance

The highest-fidelity signal for malicious account access removal is bulk operations — three or more account deletions or disablements within 60 minutes from a single account. Tune this threshold based on your environment's offboarding volume. For organizations with automated IAM pipelines, identify the service accounts used by HR systems, Active Directory lifecycle tools, or ITSM integrations (e.g., ServiceNow, SailPoint, Okta workflows) and add them to a suppression list. Suppress by SubjectUserName where the account is a known provisioning service account, not by event type. For password reset alerts (Event 4723/4724), the most actionable tuning is to create an allowlist of help desk tier accounts combined with a change ticket correlation — only alert when the subject account is NOT in your known help desk group. For process-based detections, the parent process is the strongest discriminator: net.exe spawned from explorer.exe, cmd.exe without a known admin session, or a service/scheduled task are all higher risk than net.exe spawned from a remote management tool with a known ticket. On Linux, distinguish interactive passwd calls (TTY attached, called by the account owner) from passwd calls made by root or a service process without a TTY — the latter is highly suspicious.

Hunting Queries

Hunt for accounts performing multiple user deletions or disablements, which is a strong indicator of ransomware precursor activity or an insider threat. Groups by subject account to surface single actors affecting multiple users. BurstActivity flag highlights operations concentrated within a 60-minute window — the temporal signature of automated ransomware tooling.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4725, 4726)
| summarize OperationCount=count(), AffectedAccounts=make_set(TargetUserName), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Computers=make_set(Computer) by SubjectUserName, SubjectDomainName
| where OperationCount >= 2
| extend TimeWindowMinutes = datetime_diff('minute', LastSeen, FirstSeen)
| extend BurstActivity = TimeWindowMinutes < 60
| sort by OperationCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4725 OR EventCode=4726)
earliest=-7d
| stats count as OperationCount, values(TargetUserName) as AffectedAccounts, dc(TargetUserName) as UniqueAccounts, earliest(_time) as FirstSeen, latest(_time) as LastSeen, values(host) as Computers by SubjectUserName, SubjectDomainName
| where OperationCount >= 2
| eval TimeWindowMinutes=round((LastSeen - FirstSeen) / 60, 1)
| eval BurstActivity=if(TimeWindowMinutes < 60, "YES", "NO")
| sort - OperationCount

Hunt for net.exe invocations targeting user account operations (password changes or deletions) by extracting the targeted username from the command line. This catches cases where the Security Event Log may not have captured the originating process. Excludes /add and /domain operations to reduce noise from legitimate account creation and domain queries.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("net.exe", "net1.exe")
| where ProcessCommandLine has "user" and ProcessCommandLine has_any ("/delete", "/del", "*")
| where not (ProcessCommandLine has "/add" or ProcessCommandLine has "/domain" or ProcessCommandLine has "/help")
| extend ExtractedUsername = extract(@"net\s+user\s+(\S+)", 1, tolower(ProcessCommandLine))
| where isnotempty(ExtractedUsername)
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, ExtractedUsername, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
(Image="*\\net.exe" OR Image="*\\net1.exe")
CommandLine="*user*"
NOT (CommandLine="*/add*" OR CommandLine="*/domain*" OR CommandLine="*/help*")
earliest=-7d
| rex field=CommandLine "net\s+user\s+(?P<ExtractedUsername>\S+)"
| where isnotnull(ExtractedUsername)
| table _time, host, User, CommandLine, ExtractedUsername, ParentImage, ParentCommandLine
| sort - _time

Hunt for any account deletions (Event 4726) over the past 7 days, grouped by the subject (actor) performing the deletion. Excludes computer accounts (ending in $) to focus on human account removals. Provides a full inventory of who deleted what and when — useful for baseline review and for rapidly identifying anomalous deletion actors during an active incident response.

Hunting — KQL
kql 
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4726
| join kind=leftouter (
    SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID in (4688, 4624)
    | project LogonTime=TimeGenerated, LogonComputer=Computer, LogonSubjectUser=SubjectUserName, LogonType=EventID
) on $left.SubjectUserName == $right.LogonSubjectUser and $left.Computer == $right.LogonComputer
| where TargetUserName !endswith "$"
| summarize DeletionCount=count(), DeletedAccounts=make_set(TargetUserName), Computers=make_set(Computer) by SubjectUserName, SubjectDomainName
| where DeletionCount > 0
| sort by DeletionCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4726 earliest=-7d
| where NOT match(TargetUserName, "\$$")
| stats count as DeletionCount, values(TargetUserName) as DeletedAccounts, dc(host) as AffectedHosts, values(host) as Computers, earliest(_time) as FirstDeletion, latest(_time) as LastDeletion by SubjectUserName, SubjectDomainName
| sort - DeletionCount
| eval RiskSignal=case(DeletionCount >= 5, "CRITICAL", DeletionCount >= 3, "HIGH", DeletionCount >= 2, "MEDIUM", true(), "LOW")

Atomic Red Team Tests

Test 1 Delete Local Windows User Account via Net Command
windows

Creates a temporary local user account then immediately deletes it using the net user /delete command. This simulates the account deletion pattern used by Akira ransomware and DEADWOOD malware to remove administrator accounts prior to encryption. The sequence of create-then-delete ensures the test generates both a creation baseline event and a deletion alert event.

Command

powershell 
net user df00techtest Password123! /add
net user df00techtest /delete

Cleanup

powershell 
net user df00techtest /delete 2>nul

Expected Telemetry

Security Event ID 4726 (A user account was deleted) with SubjectUserName=current admin account and TargetUserName=df00techtest. Sysmon Event ID 1 for net.exe and net1.exe with CommandLine containing 'user df00techtest /delete'. Security Event ID 4720 (account created) for the creation step.

Expected Detection

Alert fires on SecurityEvent EventID==4726 for the deletion. KQL: RiskScore=90 (AccountDeleted branch). SPL: EventCode==4726, RiskScore=90, DetectionNote='CRITICAL'. Process branch also fires on the net user /delete command line match.

Test 2 Disable Local User Account via PowerShell Set-LocalUser
windows

Creates a temporary local user account and disables it using the Set-LocalUser PowerShell cmdlet with -Enabled $false. This mirrors the Set-LocalUser and Set-ADAccountPassword patterns documented in MITRE ATT&CK for T1531, as well as LockerGoga's use of PowerShell-based account disablement. Requires local administrator privileges.

Command

powershell 
net user df00techtest2 Password123! /add
Set-LocalUser -Name df00techtest2 -Enabled $false

Cleanup

powershell 
net user df00techtest2 /delete 2>nul

Expected Telemetry

Security Event ID 4725 (A user account was disabled) with TargetUserName=df00techtest2. Sysmon Event ID 1 for powershell.exe with CommandLine containing 'Set-LocalUser' and '-Enabled $false'. PowerShell ScriptBlock Log Event ID 4104 with the full Set-LocalUser command.

Expected Detection

Alert fires on SecurityEvent EventID==4725 (RiskScore=70, AccountDisabled). Process branch fires on 'Set-LocalUser' pattern match in DeviceProcessEvents/Sysmon. KQL: IsPowerShellAccountMod=true, RiskScore=75. SPL: IsPSAccountMod=1, RiskScore=75, DetectionNote='HIGH'.

Test 3 Bulk Account Password Change Simulation via Net Command
windows

Changes the password of a temporary user account using net user with a new password, simulating the MegaCortex and LockerGoga TTP of changing account passwords to lock users out of the system. This is a lower-risk variant of the full deletion technique — adversaries often change passwords first, then delete accounts or log users off. Requires local administrator privileges.

Command

powershell 
net user df00techtest3 Password123! /add
net user df00techtest3 NewL0ckedP@ssw0rd!

Cleanup

powershell 
net user df00techtest3 /delete 2>nul

Expected Telemetry

Security Event ID 4723 (password change attempt) and/or 4724 (password reset) for df00techtest3. Sysmon Event ID 1 for net.exe with CommandLine containing 'user df00techtest3 NewL0ckedP@ssw0rd!'. The password value itself will appear in process creation logs if command line auditing is enabled.

Expected Detection

Alert fires on SecurityEvent EventID==4723/4724 (RiskScore=40-60). KQL: IsNetUserPasswordChange=true in process branch. SPL: IsNetUserPasswordChange=1, RiskScore=65. Note: this represents the ransomware pre-encryption phase and should be correlated with other impact indicators for high-confidence alerting.

Test 4 Linux Account Lock via passwd -l
linux

Creates a temporary Linux user and locks the account using passwd -l, which prepends a '!' to the password hash in /etc/shadow, preventing password-based authentication. This simulates Linux-based account access removal, which may be used on compromised Linux servers or in multi-platform ransomware attacks. Requires root or sudo privileges.

Command

bash 
useradd -m df00techtest_linux
passwd -l df00techtest_linux

Cleanup

bash 
userdel -r df00techtest_linux 2>/dev/null

Expected Telemetry

Linux auditd records: syscall=execve for useradd and passwd commands with argv showing '-l df00techtest_linux'. Syslog entries in /var/log/auth.log or /var/log/secure: 'passwd: password changed for df00techtest_linux'. If auditd is configured with USER_MGMT rules, generates AUDIT_USER_MGMT events for account modification.

Expected Detection

SPL syslog/linux_secure branch detects passwd with non-self argument. KQL DeviceProcessEvents branch detects FileName='passwd' with ProcessCommandLine containing '-l'. Alert severity Medium (RiskScore=50, IsLinuxAccountMod indicator). Correlation with useradd + passwd -l in sequence is a stronger signal.

Related Detections

Tactic Hub

TA0040 Impact

Detection Variants (1)

Different telemetry and tradecraft for the same technique — pick the one that matches the data you collect.

Related Techniques

T1486 Data Encrypted for Impact T1490 Inhibit System Recovery T1489 Service Stop T1485 Data Destruction T1078 Valid Accounts T1078.002 Domain Accounts T1078.004 Cloud Accounts T1529 System Shutdown/Reboot T1098 Account Manipulation T1136 Create Account

Same Tactic: Impact

Popular Detections