1. Home
  2. Techniques
  3. Account Manipulation

Account Manipulation

Sub-techniques (5)
ID Name
T1098.001 Additional Cloud Credentials
T1098.003 Additional Cloud Roles

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts [MITRE] .

Detection

Collect events that correlate with changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.(Citation: Microsoft User Modified Event)(Citation: Microsoft Security Event 4670)(Citation: Microsoft Security Event 4670) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017) Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity. Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078)

References

  1. mitre-attack
  2. FireEye SMOKEDHAM June 2021
  3. Microsoft Security Event 4670
  4. Microsoft User Modified Event
  5. InsiderThreat ChangeNTLM July 2017

Technique Information

ID: T1098
Aliases: T1098
Sub-techniques:
Tactics:
  • Persistence
  • Privilege Escalation
Platforms:
  • Windows
  • Azure AD
  • Office 365
  • IaaS
  • Linux
  • macOS
  • Google Workspace
  • SaaS
  • Network
  • Containers
  • Amazon Web Services (AWS)
Created: 31 May 2017
Last Modified: 03 Jun 2025