T1531

Account Access Removal

Index entry

In-depth coverage of this technique (how it looks in telemetry, how to hunt it, and how to rule out benign activity) is coming soon. It's in our catalog and on the roadmap to be written up.

View this technique on MITRE ATT&CK →

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

Entra ID sign-in logs (the log as a whole)
ESXi and vCenter logs (the log as a whole)
Linux audit framework (auditd) (the log as a whole)
Microsoft 365 Unified Audit Log
- Remove-Mailbox
- Set-Mailbox
macOS unified log (the log as a whole)
Network flow records (Zeek conn, NetFlow, firewall flow) (the log as a whole)
Okta System Log
Windows Security event log
- 4723 An attempt was made to change an account's password.
- 4724 An attempt was made to reset an account's password.
- 4740 A user account was locked out.
Sysmon
- 1 Process creation