T1531 Account Access Removal
Adversaries may interrupt availability of system and network resources by inhibiting access to accounts utilized by legitimate users. MITRE ATT&CK
2 Sigma rules T1531 on attack.mitre.org
Sigma rules tagged with it
Command lines CmdID reads as it
Remove a user in other root directory on the page for userdel
sudo userdel --root path/to/other_root usernameIdentifyRemove a user along with the home directory and mail spool on the page for userdel
sudo userdel --remove usernameIdentifyAn example is here when CmdID’s reading of it names T1531: a Sigma rule it trips is tagged with it, or its abuse is documented as it.