1. Home
  2. ATT&CK Techniques
  3. T1098 Account Manipulation

T1098 Account Manipulation Mappings

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
intel-ptt Intel Platform Trust Technology Win 11, ESS/Hello T1098 Account Manipulation
Comments
Windows Hello ESS authentication leverages virtual sandbox(Intel VT-X) to protect authentication data to significantly reduce the risk of brute force attacks on passwords, as biometrics typically require physical presence or biometric data that cannot be easily guessed or replicated. It uses the TPM (Intel PTT) to store authentication data including public/private key pairs. Windows Hello also includes Passkeys, a passwordless authentication option that generates public/private key pair with the public key shared with the service requiring authentication and the private key stored in the TPM, which is only released after authentication locally on the device using either a biometric factor such as fingerprint, facial recognition, or a PIN. Windows Hello helps protect against the risk of credentials being stored in files by eliminating the need for passwords in many authentication scenarios. Windows Hello utilizes passkeys which helps protect against the risk of credentials being stored in files by eliminating the need for passwords.
References
  1. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/
  2. https://learn.microsoft.com/en-us/windows/security/identity-protection/passwordless-strategy/
  3. https://learn.microsoft.com/en-us/windows/security/identity-protection/hello-for-business/faq
  4. https://learn.microsoft.com/en-us/virtualization/hyper-v-on-windows/tlfs/vsm
  5. https://support.microsoft.com/en-us/windows/passkeys-overview-301c8944-5ea2-452b-9886-97e4d2ef4422
  6. https://www.intel.com/content/dam/www/central-libraries/us/en/documents/white-paper-intel-hardware-shield.pdf
  7. https://learn.microsoft.com/en-us/windows/security/identity-protection/passkeys/?tabs=windows%2Cintune
  8. https://learn.microsoft.com/en-us/windows-hardware/design/device-experiences/windows-hello-enhanced-sign-in-security
  9. https://www.intel.com/content/www/us/en/business/enterprise-computers/resources/trusted-platform-module.html
  10. https://www.intel.com/content/www/us/en/business/enterprise-computers/resources/virtualization-security.html

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1098.002 Additional Email Delegate Permissions 1