Account Manipulation

T1098

Technique with 7 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Detection rules107

Rules on DetectionCode tagged with T1098 or one of its sub-techniques.

Sigma41

Rule	Level	Log source	Technique
Active Directory User Backdoors	high	windows / NULL	T1098
Added Credentials to Existing Application	high	azure / NULL	T1098.001
Anomalous User Activity	high	azure / NULL	T1098
App Granted Privileged Delegated Or App Permissions	high	azure / NULL	T1098.003
AWS User Login Profile Was Modified	high	aws / NULL	T1098
Bulk Deletion Changes To Privileged Account Permissions	high	azure / NULL	T1098
Cisco Local Accounts	high	cisco / NULL	T1098
Enabled User Right in AD to Control User Objects	high	windows / NULL	T1098
ESXi Admin Permission Assigned To Account Via ESXCLI	high	linux / process_creation	T1098
Password Change on Directory Service Restore Mode (DSRM) Account	high	windows / NULL	T1098
Powerview Add-DomainObjectAcl DCSync AD Extend Right	high	windows / NULL	T1098
Privileged User Has Been Created	high	linux / NULL	T1098
User Added To Highly Privileged Group	high	windows / process_creation	T1098
Windows LAPS Credential Dump From Entra ID	high	azure / NULL	T1098.005
A New Trust Was Created To A Domain	medium	windows / NULL	T1098
App Assigned To Azure RBAC/Microsoft Entra Role	medium	azure / NULL	T1098.003
AWS IAM Backdoor Users Keys	medium	aws / NULL	T1098
Bitbucket Global Permission Changed	medium	bitbucket / NULL	T1098
Change to Authentication Method	medium	azure / NULL	T1098
DMSA Service Account Created in Specific OUs - PowerShell	medium	windows / ps_script	T1098
GCP Access Policy Deleted	medium	gcp / NULL	T1098
Github Outside Collaborator Detected	medium	github / NULL	T1098.001 T1098.003
Google Workspace Application Access Level Modified	medium	gcp / NULL	T1098.003
Google Workspace Granted Domain API Access	medium	gcp / NULL	T1098
Google Workspace User Granted Admin Privileges	medium	gcp / NULL	T1098
Granting Of Permissions To An Account	medium	azure / NULL	T1098.003
New DMSA Service Account Created in Specific OUs	medium	windows / process_creation	T1098
Number Of Resource Creation Or Deployment Activities	medium	azure / NULL	T1098
Okta Admin Role Assigned to an User or Group	medium	okta / NULL	T1098.003
Okta Identity Provider Created	medium	okta / NULL	T1098.001
Password Set to Never Expire via WMI	medium	windows / process_creation	T1098
Powershell LocalAccount Manipulation	medium	windows / ps_script	T1098
User Added to an Administrator's Azure AD Role	medium	azure / NULL	T1098.003
User Added to Local Administrator Group	medium	windows / NULL	T1098
User Added to Local Administrators Group	medium	windows / process_creation	T1098
A Member Was Added to a Security-Enabled Global Group	low	windows / NULL	T1098
A Member Was Removed From a Security-Enabled Global Group	low	windows / NULL	T1098
A Security-Enabled Global Group Was Deleted	low	windows / NULL	T1098
AWS Route 53 Domain Transfer Lock Disabled	low	aws / NULL	T1098
AWS Route 53 Domain Transferred to Another Account	low	aws / NULL	T1098
DMSA Link Attributes Modified	low	windows / ps_script	T1098

Splunk66

Rule	Type	Risk	Data source	Technique
ASL AWS IAM Delete Policy	Hunting	NULL	ASL AWS CloudTrail	T1098
ASL AWS IAM Failure Group Deletion	Anomaly	NULL	ASL AWS CloudTrail	T1098
ASL AWS IAM Successful Group Deletion	Hunting	NULL	ASL AWS CloudTrail	T1098
AWS IAM Delete Policy	Hunting	NULL	AWS CloudTrail DeletePolicy	T1098
AWS IAM Failure Group Deletion	Anomaly	NULL	AWS CloudTrail DeleteGroup	T1098
AWS IAM Successful Group Deletion	Hunting	NULL	AWS CloudTrail DeleteGroup	T1098
Azure AD Admin Consent Bypassed by Service Principal	TTP	NULL	Azure Active Directory Add app role assignment to service principal	T1098.003
Azure AD Application Administrator Role Assigned	TTP	NULL	Azure Active Directory Add member to role	T1098.003
Azure AD FullAccessAsApp Permission Assigned	TTP	NULL	Azure Active Directory Update application	T1098.002 T1098.003
Azure AD Global Administrator Role Assigned	TTP	NULL	Azure Active Directory Add member to role	T1098.003
Azure AD New MFA Method Registered	TTP	NULL	Azure Active Directory Update user	T1098.005
Azure AD PIM Role Assigned	TTP	NULL	Azure Active Directory	T1098.003
Azure AD PIM Role Assignment Activated	TTP	NULL	Azure Active Directory	T1098.003
Azure AD Privileged Role Assigned	TTP	NULL	Azure Active Directory Add member to role	T1098.003
Azure AD Privileged Role Assigned to Service Principal	TTP	NULL	Azure Active Directory Add member to role	T1098.003
Azure AD Service Principal New Client Credentials	TTP	NULL	Azure Active Directory	T1098.001
Azure AD Service Principal Owner Added	TTP	NULL	Azure Active Directory Add owner to application	T1098
Azure AD Service Principal Privilege Escalation	TTP	NULL	Azure Active Directory Add app role assignment to service principal	T1098.003
Azure AD Tenant Wide Admin Consent Granted	TTP	NULL	Azure Active Directory Consent to application	T1098.003
Azure AD User Enabled And Password Reset	TTP	NULL	Azure Active Directory Enable account, Azure Active Directory Reset password (by admin), Azure Active Directory Update user	T1098
Azure AD User ImmutableId Attribute Updated	TTP	NULL	Azure Active Directory Update user	T1098
Cisco ASA - User Privilege Level Change	Anomaly	NULL	Cisco ASA Logs	T1098
Cisco Configuration Archive Logging Analysis	Hunting	NULL	Cisco IOS Logs	T1098
ESXi Account Modified	Anomaly	NULL	VMWare ESXi Syslog	T1098
ESXi User Granted Admin Role	TTP	NULL	VMWare ESXi Syslog	T1098
Linux Auditd Possible Access Or Modification Of Sshd Config File	Anomaly	NULL	Linux Auditd Path, Linux Auditd Cwd	T1098.004
Linux Possible Access Or Modification Of sshd Config File	Anomaly	NULL	Sysmon for Linux EventID 1	T1098.004
Linux Possible Ssh Key File Creation	Anomaly	NULL	Sysmon for Linux EventID 11	T1098.004
Linux SSH Authorized Keys Modification	Anomaly	NULL	Sysmon for Linux EventID 1	T1098.004
Linux Usermod Root UID Set	TTP	NULL	Sysmon for Linux EventID 1	T1098
O365 Admin Consent Bypassed by Service Principal	TTP	NULL	O365 Add app role assignment to service principal.	T1098.003
O365 Application Available To Other Tenants	TTP	NULL	Office 365 Universal Audit Log	T1098.003
O365 Application Registration Owner Added	TTP	NULL	O365 Add owner to application.	T1098
O365 ApplicationImpersonation Role Assigned	TTP	NULL	O365	T1098.002
O365 Elevated Mailbox Permission Assigned	TTP	NULL	O365 Add-MailboxPermission	T1098.002
O365 FullAccessAsApp Permission Assigned	TTP	NULL	O365 Update application.	T1098.002 T1098.003
O365 High Privilege Role Granted	TTP	NULL	O365 Add member to role.	T1098.003
O365 Mailbox Folder Read Permission Assigned	TTP	NULL	O365 ModifyFolderPermissions	T1098.002
O365 Mailbox Folder Read Permission Granted	TTP	NULL	O365 ModifyFolderPermissions	T1098.002
O365 Mailbox Read Access Granted to Application	TTP	NULL	O365 Update application.	T1098.003
O365 New MFA Method Registered	TTP	NULL	O365 Update user.	T1098.005
O365 Privileged Role Assigned	TTP	NULL	Office 365 Universal Audit Log	T1098.003
O365 Privileged Role Assigned To Service Principal	TTP	NULL	Office 365 Universal Audit Log	T1098.003
O365 Service Principal New Client Credentials	TTP	NULL	O365	T1098.001
O365 Service Principal Privilege Escalation	TTP	NULL	O365 Add app role assignment grant to user.	T1098.003
O365 Suspicious Rights Delegation	TTP	NULL		T1098.002
O365 Tenant Wide Admin Consent Granted	TTP	NULL	O365 Consent to application.	T1098.003
Okta New Device Enrolled on Account	TTP	NULL	Okta	T1098.005
PingID Mismatch Auth Source and Verification Response	TTP	NULL	PingID	T1098.005
PingID New MFA Method After Credential Reset	TTP	NULL	PingID	T1098.005
PingID New MFA Method Registered For User	TTP	NULL	PingID	T1098.005
Windows AD add Self to Group	TTP	NULL	Windows Event Log Security 4728	T1098
Windows AD DSRM Account Changes	TTP	NULL	Sysmon EventID 13	T1098
Windows AD DSRM Password Reset	TTP	NULL	Windows Event Log Security 4794	T1098
Windows AD Privileged Group Modification	TTP	NULL	Windows Event Log Security 4728	T1098
Windows AD Self DACL Assignment	TTP	NULL	Windows Event Log Security 5136	T1098
Windows AD ServicePrincipalName Added To Domain Account	TTP	NULL	Windows Event Log Security 5136	T1098
Windows AD Short Lived Domain Account ServicePrincipalName	TTP	NULL	Windows Event Log Security 5136	T1098
Windows Azure PowerShell Module Installation Via PowerShell Script	Anomaly	NULL	Powershell Script Block Logging 4104	T1098
Windows DnsAdmins New Member Added	TTP	NULL	Windows Event Log Security 4732	T1098
Windows Entra User Management Via Azure CLI	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1098
Windows Increase in Group or Object Modification Activity	TTP	NULL	Windows Event Log Security 4663	T1098
Windows Increase in User Modification Activity	TTP	NULL	Windows Event Log Security 4720	T1098
Windows Multiple Account Passwords Changed	TTP	NULL	Windows Event Log Security 4724	T1098
Windows Multiple Accounts Deleted	TTP	NULL	Windows Event Log Security 4726	T1098
Windows Multiple Accounts Disabled	TTP	NULL	Windows Event Log Security 4725	T1098

Sub-techniques7

ID	Name	Examples
T1098.001	Additional Cloud Credentials	4
T1098.002	Additional Email Delegate Permissions	5
T1098.003	Additional Cloud Roles	5
T1098.004	SSH Authorized Keys	7
T1098.005	Device Registration	4
T1098.006	Additional Container Cluster Roles	0
T1098.007	Additional Local or Domain Groups	11

Groups5

Software3

Calisto Mimikatz Shai-Hulud

Campaigns1

2016 Ukraine Electric Power Attack

Procedure examples9

Groups5

Used by	Procedure example
GroupHAFNIUM	HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts. Microsoft Silk Typhoon MAR 2025 Volexity Exchange Marauder March 2021
GroupLazarus Group	Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account. Novetta Blockbuster Novetta Blockbuster Destructive Malware
GroupScattered Spider	Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere. Mandiant VMware vSphere JUL 2025
GroupTeamPCP	TeamPCP has modified settings to publish private Aqua Security repositories to GitHub as public. Aqua Security Blog Trivy Compromise APR 2026
GroupVOID MANTICORE	VOID MANTICORE has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access. Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026 SEC 8K Palo Alto Statement Stryker Corp Handala March 2026

Software3

Used by	Procedure example
MalwareCalisto	Calisto adds permissions and remote logins to all users. Symantec Calisto July 2018
ToolMimikatz	The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The `LSADUMP::ChangeNTLM` and `LSADUMP::SetNTLM` modules can also manipulate the password hash of an account without knowing the clear text value. Adsecurity Mimikatz Guide Metcalf 2015
MalwareShai-Hulud	Shai-Hulud has modified GitHub account settings for private repositories and changed them to public. Aikido Shai-Hulud September 2025 Microsoft Shai-Hulud December 2025 Netskope Shai-Hulud November 2025 Wiz Shai-Hulud September 2025

Campaigns1

Used by	Procedure example
Campaign2016 Ukraine Electric Power Attack	During the 2016 Ukraine Electric Power Attack, Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network. Dragos Crashoverride 2018

References1

FireEye SMOKEDHAM June 2021 Open source
FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.