T1531 / ATT&CK

Windows Analytic 0334

Correlated user account modification (reset, disable, deletion) events with anomalous process lineage (e.g., PowerShell or net.exe from an interactive session), especially outside of IT admin change windows or by non-admin users.

• WinEventLog:Security EventCode=4723, 4724, 4740
• WinEventLog:Sysmon EventCode=1

Linux Analytic 0335

Password changes or account deletions via 'passwd', 'userdel', or 'chage' preceded by interactive shell or remote command execution from non-privileged accounts.

• auditd:SYSCALL SYSCALL record where exe contains passwd/userdel/chage and auid != root
• NSM:Connections Accepted password or publickey for user from remote IP

macOS Analytic 0336

Execution of dscl or sysadminctl commands to disable, delete, or modify users combined with anomalous process ancestry or terminal session launch.

• macos:unifiedlog command includes dscl . delete or sysadminctl --deleteUser
• macos:unifiedlog successful sudo or authentication for account not normally associated with admin actions

ESXi Analytic 0337

Invocation of esxcli 'system account remove' from vCLI, SSH, or vSphere API with anomalous user access or outside maintenance windows.

• esxi:hostd method=RemoveUser or esxcli system account remove invocation
• esxi:vpxa user login from unexpected IP or non-admin user role

Office Suite Analytic 0338

O365 UnifiedAuditLog entries for Remove-Mailbox or Set-Mailbox with account disable or delete actions correlated with suspicious login locations or MFA bypass.

• m365:unified Remove-Mailbox, Set-Mailbox
• m365:signinlogs Sign-in from anomalous location or impossible travel condition

SaaS Analytic 0339

Deletion or disablement of user accounts in platforms like Okta, Salesforce, or Zoom with anomalies in admin session attributes or mass actions within short duration.

• saas:okta user.lifecycle.delete, user.account.lock