Threadlinqs IntelligenceStart free

ATT&CK techniqueImpact

T1531 Account Access Removal

ImpactEnterprise

As of 2026-10-05, T1531 (Account Access Removal) appears in 139 tracked threats, first reported 2026-02-02 and most recently 2026-09-25, with linked actors including TeamPCP, Scattered LAPSUS$ Hunters, ShinyHunters; it most often appears alongside T1005 (Data from Local System).

Tracked threats
13947 critical, 72 high, 18 medium, 2 low
First seen
2026-02-02
Last seen
2026-09-25
Threat actors
59In the threats using it
Detection rules
74Blue tier and above

Data as of:

Activity timeline

T1531 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 63 reports, and 139 of the 139 threats were reported in the twelve months to 2026-09.

How adversaries use it

T1531 Account Access Removal is catalogued by MITRE ATT&CK under the Impact tactic in the Enterprise matrix. Threadlinqs maps 139 of 2623 tracked threats (5.3%) to it; by severity that is 47 critical, 72 high, 18 medium, 2 low.

Threats that use T1531 most often also use T1005 Data from Local System (65 threats), T1190 Exploit Public-Facing Application (60 threats), T1041 Exfiltration Over C2 Channel (56 threats), T1078 Valid Accounts (56 threats), T1539 Steal Web Session Cookie (55 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

59 tracked threat actors appear in the threats that use T1531; the most frequent are TeamPCP (6), Scattered LAPSUS$ Hunters (3), ShinyHunters (3), Void Manticore (3), APT44 (2).

Data sources

Telemetry that can reveal T1531, per MITRE ATT&CK.

  • Active Directory — Active Directory Object Modification
  • User Account — User Account Deletion, User Account Modification

Threat actors using it

Tracked threats

The 30 most recent of 139 tracked threats that use T1531.

Detection coverage

Threadlinqs maintains 74 detection rules mapped to T1531 (SPL 18, KQL 26, Sigma 30). Rule content is available to Blue tier accounts and above; this page shows counts only.

74 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans