T1531 — Account Access Removal

# T1531 - Account Access Removal

## SOC Recommendation
Investigate Account Access Removal activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| Agent Authentication | Harden | Apply Agent Authentication to reduce this technique's viability before an incident occurs. |
| Account Locking | Evict | Use Account Locking to remove the adversary's foothold once this technique is confirmed. |
| User Account Permissions | Isolate | Apply User Account Permissions to contain the blast radius once this technique is observed. |
| Unlock Account | Restore | Use Unlock Account to recover affected systems or data after containment. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| Re-enable affected accounts via break-glass / emergency admi | Low | No | Yes |
| Revoke the actor's privileges if this was an attacker action | Medium | No | Yes |
| Verify break-glass account is not compromised | Low | No | Yes |

## KQL
```kql
SAPBTPAuditLog_CL
| extend LogMessage = coalesce(tostring(Message.message), tostring(Message.data), tostring(Message))
| where LogMessage has_any ("Unauthorized access to the oData service", 
                            "All roles for providerId", 
                            "All users for providerId",
                            "were deleted successfully",
                            "were removed successfully")
| extend EventCategory = case(
    LogMessage contains "Unauthorized access", "Unauthorized Access",
    LogMessage contains "All roles" or LogMessage contains "All users", "Mass Deletion",
    "Role Tampering"
)
| extend MessageText = case(
    LogMessage contains "Unauthorized access to the oData service", "Unauthorized OData service access attempt",
    LogMessage contains "All roles for providerId" and LogMessage contains "deleted", "Mass role deletion detected",
    LogMessage contains "All users for providerId" and LogMessage contains "deleted", "Mass user deletion detected",
    LogMessage contains "assignments were removed", "User/role assignments removed",
    "Suspicious access control modification"
)
| extend ProviderId = extract(@"providerId\s+(\S+)", 1, LogMessage)
| project
    TimeGenerated,
    UserName,
    MessageText,
    EventCategory,
    ProviderId,
    Tenant,
    CloudApp = "SAP Build Work Zone Standard Edition"
| extend AccountName = split(UserName, "@")[0], UPNSuffix = split(UserName, "@")[1]
```
```kql
ValimailEnforceEvents_CL
| where EventCategory == "UserManagement"
| where EventSeverity == "High"
| where IsHighValueEvent == true
| summarize
    EventCount = count(),
    FirstSeen = min(PerformedAt),
    LastSeen = max(PerformedAt),
    AffectedUsers = make_set(Subject),
    Actions = make_set(EventType)
  by User, EventCategory
| extend
    AccountName = tostring(split(User, "@")[0]),
    AccountDomain = tostring(split(User, "@")[1])
```
```kql
JiraAudit
| where EventMessage =~ 'Permission scheme updated'
| project EventCreationTime, ObjectItemName, UserName, SrcIpAddr, ChangedValues
| extend AccountCustomEntity = UserName, IPCustomEntity = SrcIpAddr
```

## Escalation Criteria
- Account Access Removal activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1531.json
• /api/recommendations/T1531.json
• /api/d3fend/T1531.json
• /api/mappings/T1531.json
• /api/confluence/T1531.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1531.json

Response:

{
  "technique_id": "T1531",
  "name": "Account Access Removal",
  "priority": "high",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Impact"
  ],
  "platforms": [
    "Linux",
    "macOS",
    "Windows",
    "SaaS",
    "IaaS",
    "Office Suite",
    "ESXi"
  ],
  "summary": "Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. Accounts may be deleted, locked, or manipulated (ex: changed credentials, revoked permissions for SaaS platforms such as Sharepoint) to remove access to accounts. Adversaries may also subsequently log off and/or perform a [System Shutdown/Reboot](https://attack.mitre.org/techniques/T1529) to set malicious changes into place...",
  "soc_recommendation": "Investigate Account Access Removal activity in the context of Impact: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-AA",
      "name": "Agent Authentication",
      "relationship": "harden",
      "practical_action": "Apply Agent Authentication to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-AL",
      "name": "Account Locking",
      "relationship": "evict",
      "practical_action": "Use Account Locking to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Entra ID"
      ]
    },
    {
      "id": "D3-UAP",
      "name": "User Account Permissions",
      "relationship": "isolate",
      "practical_action": "Apply User Account Permissions to contain the blast radius once this technique is observed.",
      "tooling": [
        "Entra ID"
      ]
    },
    {
      "id": "D3-ULA",
      "name": "Unlock Account",
      "relationship": "restore",
      "practical_action": "Use Unlock Account to recover affected systems or data after containment.",
      "tooling": [
        "Entra ID"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed account access removal activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"BTP - Build Work Zone unauthorized access and role tampering\" -- Identifies unauthorized OData access attempts and mass role/user deletions in SAP Build Work Zone Standard Edition. These events may indicate an attacker accessing restricted resources or removing access controls to cover their tracks."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "Re-enable affected accounts via break-glass / emergency admi",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "Re-enable affected accounts via break-glass / emergency admin account"
    },
    {
      "name": "Revoke the actor's privileges if this was an attacker action",
      "category": "Response",
      "risk": "Medium",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    },
    {
      "name": "Verify break-glass account is not compromised",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "8e5f3a2c-9d1b-4c6e-a7f8-3b2d1e0c9a5f — BTP - Build Work Zone unauthorized access and role tampering",
        "description": "Identifies unauthorized OData access attempts and mass role/user deletions in SAP Build Work Zone Standard Edition. These events may indicate an attacker accessing restricted resources or removing access controls to cover their tracks. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "SAPBTPAuditLog_CL\n| extend LogMessage = coalesce(tostring(Message.message), tostring(Message.data), tostring(Message))\n| where LogMessage has_any (\"Unauthorized access to the oData service\", \n                            \"All roles for providerId\", \n                            \"All users for providerId\",\n                            \"were deleted successfully\",\n                            \"were removed successfully\")\n| extend EventCategory = case(\n    LogMessage contains \"Unauthorized access\", \"Unauthorized Access\",\n    LogMessage contains \"All roles\" or LogMessage contains \"All users\", \"Mass Deletion\",\n    \"Role Tampering\"\n)\n| extend MessageText = case(\n    LogMessage contains \"Unauthorized access to the oData service\", \"Unauthorized OData service access attempt\",\n    LogMessage contains \"All roles for providerId\" and LogMessage contains \"deleted\", \"Mass role deletion detected\",\n    LogMessage contains \"All users for providerId\" and LogMessage contains \"deleted\", \"Mass user deletion detected\",\n    LogMessage contains \"assignments were removed\", \"User/role assignments removed\",\n    \"Suspicious access control modification\"\n)\n| extend ProviderId = extract(@\"providerId\\s+(\\S+)\", 1, LogMessage)\n| project\n    TimeGenerated,\n    UserName,\n    MessageText,\n    EventCategory,\n    ProviderId,\n    Tenant,\n    CloudApp = \"SAP Build Work Zone Standard Edition\"\n| extend AccountName = split(UserName, \"@\")[0], UPNSuffix = split(UserName, \"@\")[1]"
      },
      {
        "name": "e960f5b0-cd80-474a-996a-013ff3989772 — Valimail Enforce - High-Value User Management Event",
        "description": "This query searches for high-severity user management events such as user deletion or deactivation in Valimail Enforce, which may indicate unauthorized access or insider threat. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "ValimailEnforceEvents_CL\n| where EventCategory == \"UserManagement\"\n| where EventSeverity == \"High\"\n| where IsHighValueEvent == true\n| summarize\n    EventCount = count(),\n    FirstSeen = min(PerformedAt),\n    LastSeen = max(PerformedAt),\n    AffectedUsers = make_set(Subject),\n    Actions = make_set(EventType)\n  by User, EventCategory\n| extend\n    AccountName = tostring(split(User, \"@\")[0]),\n    AccountDomain = tostring(split(User, \"@\")[1])"
      },
      {
        "name": "72592618-fa57-45e1-9f01-ca8706a5e3f5 — Jira - Permission scheme updated",
        "description": "Detects when permission scheme was updated.' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "JiraAudit\n| where EventMessage =~ 'Permission scheme updated'\n| project EventCreationTime, ObjectItemName, UserName, SrcIpAddr, ChangedValues\n| extend AccountCustomEntity = UserName, IPCustomEntity = SrcIpAddr"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "2820c9c2-bcd7-4d6e-9eba-faf3891ba450 — Account Password Reset Remotely",
        "description": "(EQL) Identifies an attempt to reset a potentially privileged account password remotely. Adversaries may manipulate account passwords to maintain access or evade password duration policies and preserve compromised credentials. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "sequence by winlog.computer_name with maxspan=1m\n  [authentication where host.os.type == \"windows\" and event.action == \"logged-in\" and\n    /* event 4624 need to be logged */\n    winlog.logon.type : \"Network\" and event.outcome == \"success\" and source.ip != null and\n    source.ip != \"127.0.0.1\" and source.ip != \"::1\" and\n    not winlog.event_data.TargetUserName : (\"svc*\", \"PIM_*\", \"_*_\", \"*-*-*\", \"*$\")] by winlog.event_data.TargetLogonId\n   /* event 4724 need to be logged */\n  [iam where host.os.type == \"windows\" and event.action == \"reset-password\" and\n   (\n    /*\n       This rule is very noisy if not scoped to privileged accounts, duplicate the\n       rule and add your own naming convention and accounts of interest here.\n     */\n    winlog.event_data.TargetUserName: (\"*Admin*\", \"*super*\", \"*SVC*\", \"*DC0*\", \"*service*\", \"*DMZ*\", \"*ADM*\") or\n    winlog.event_data.TargetSid : (\"S-1-5-21-*-500\", \"S-1-12-1-*-500\")\n    )\n  ] by winlog.event_data.SubjectLogonId"
      },
      {
        "name": "3c216ace-2633-4911-9aac-b61d4dc320e8 — SSH Authorized Keys File Deletion",
        "description": "(EQL) This rule detects the deletion of the authorized_keys or authorized_keys2 files on Linux systems. These files are used to store public keys for SSH authentication. Unauthorized deletion of these files can be an indicator of an attacker removing access to the system, and may be a precursor to further malicious activity. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "file where host.os.type == \"linux\" and event.type == \"deletion\" and file.name in (\"authorized_keys\", \"authorized_keys2\") and\nnot (\n  process.executable in (\n    \"/usr/bin/google_guest_agent\", \"/usr/bin/dockerd\", \"/bin/dockerd\", \"/usr/bin/containerd\"\n  ) or\n  process.executable like~ \"/nix/store/*\" or\n  file.path like~ (\"*backup*\", \"*ansible*\", \"*puppet*\")\n)"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "Account Access Removal activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1531 - Account Access Removal Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}