Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| cloud_asset_inventory | Cloud Asset Inventory | technique_scores | T1098 | Account Manipulation |
Comments
This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies. This monitoring can be fine tuned to specific assets, policies, and organizations.
References
|
| resourcemanager | ResourceManager | technique_scores | T1098 | Account Manipulation |
Comments
GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers.
References
|
| identityplatform | IdentityPlatform | technique_scores | T1098 | Account Manipulation |
Comments
Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels.
References
|
| chronicle | Chronicle | technique_scores | T1098 | Account Manipulation |
Comments
Chronicle is able to trigger an alert to ensure multi-factor authentication is enabled for all non-service and administrator accounts.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_multifactor_authentication.yaral
References
|
| advancedprotectionprogram | AdvancedProtectionProgram | technique_scores | T1098 | Account Manipulation |
Comments
Advanced Protection Program enables the use of a security key for multi-factor authentication. This provides significant protection against unauthorized users from accessing and manipulating accounts to retain access.
References
|
| virtual_private_cloud | Virtual Private Cloud | technique_scores | T1098 | Account Manipulation |
Comments
VPC further segments the environment by providing configurable granular access controls which help limit user communications to critical systems.
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1098 | Account Manipulation |
Comments
Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.
References
|
| identity_and_access_management | Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1098.003 | Add Office 365 Global Administrator Role | 1 |
| T1098.001 | Additional Cloud Credentials | 9 |
| T1098.002 | Exchange Email Delegate Permissions | 1 |
| T1098.004 | SSH Authorized Keys | 1 |