Home
ATT&CK Techniques
T1098 Account Manipulation

T1098 Account Manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

View in MITRE ATT&CK®

CRI Profile Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
PR.IR-01.05	Remote access protection	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement implements security controls and restrictions for remote user access to systems. Remote user access control involves managing and securing how users remotely access systems, such as through encrypted connections and account use policies, which help prevent adversary access. References
PR.IR-01.04	Wireless network protection	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides protections for wireless networks. Implementation of wireless network management measures such as network segmentation and access controls reduces the attack surface, restricts movement by adversaries, and protects data from compromise. References
PR.PS-01.01	Configuration baselines	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides for securely configuring production systems. This includes hardening default configurations and making security-focused setting adjustments to reduce the attack surface, enforce best practices, and protect sensitive data thereby mitigating adversary exploitation. References
PR.PS-01.02	Least functionality	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides for limiting unnecessary software, services, ports, protocols, etc. Ensuring systems only have installed and enabled what is essential for their operation reduces the attack surface and minimizes vulnerabilities, which mitigates a wide range of techniques. References
PR.AA-05.02	Privileged system access	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement protects against Account Manipulation through the use of privileged account management and the use of multi-factor authentication. References
DE.CM-06.02	Third-party access monitoring	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement protects against Account Manipulation through the use of privileged account management. Employing auditing, privilege access management, and just in time access protects against adversaries trying to obtain illicit access to critical systems. References
PR.AA-02.01	Authentication of identity	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides protection from Account Manipulation through the implementation of privileged account management controls to limit credential access. Employing limitations to specific accounts, access control mechanisms, and auditing the attribution logs provides protection against adversaries attempting to modify accounts. References
PR.AA-04.01	Access control within and across security perimeters	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides protection from Account Manipulation through the implementation of privileged account management controls to limit credential access. Employing limitations to specific accounts, access control mechanisms, and auditing the attribution logs provides protection against adversaries attempting to modify accounts. References
PR.AA-05.01	Access privilege limitation	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement describes the implementation of least privilege principle, which can be applied to limiting permissions through role-based access controls, file and directory permissions, and the execution of systems and services. An adversary must already have high-level, admin or root level access on a local system to make full use of these ATT&CK techniques. Restrict users and accounts to the least privileges they require can help mitigate these techniques References
PR.PS-01.03	Configuration deviation	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides protection from Account Manipulation through the implementation of security configuration baselines for OS, software, file integrity monitoring and imaging. Security baseline configuration of the Operating System and integrity checking can help protect against adversaries attempting to compromise and modify software and its configurations. References
PR.PS-01.07	Cryptographic keys and certificates	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement protects against Account Manipulation through the use of revocation of keys and key management. Employing limitations to specific accounts along with access control mechanisms provides protection against adversaries attempting to manipulate accounts. References
PR.PS-01.09	Virtualized end point protection	Mitigates	T1098	Account Manipulation	Comments The diagnostic statement highlights several mechanisms that organizations can implement to protect endpoint systems using virtualization technologies, essentially hypervisor hardening. Use multi-factor authentication for user and privileged accounts running virtual machines. References
PR.AA-05.03	Service accounts	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement describes how the organization establishes security standards based on industry guidelines to institute strict controls over service account (i.e., accounts used by systems to access other systems). References
DE.CM-03.03	Privileged account monitoring	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement implements mechanisms and tools to mitigate potential misuse of privileged users and accounts. Continuous monitoring of role and attribute assignments and activity is essential to prevent and detect unauthorized access or misuse. References
PR.AA-01.02	Physical and logical access	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement describes how the organization ensures users are identified and authenticated before accessing systems, applications, and hardware, with logical access controls permitting access only to authorized individuals with legitimate business needs. Logical access controls in relation to systems can refer to the use of MFA, user account management, and other role-based access control mechanisms to enforce policies for authentication and authorization of user accounts. References
PR.AA-03.01	Authentication requirements	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement describes how the organization implement appropriate authentication requirements, including selecting mechanisms based on risk, utilizing multi-factor authentication where necessary, and safeguarding the storage of authenticators like pins and passwords to protect sensitive access credentials. References
PR.IR-01.01	Network segmentation	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement is for the implementation of network segmentation which helps prevent access to critical systems and sensitive information. Employing proper network segmentation limits access to critical systems and domain controllers. References
PR.IR-01.06	Production environment segregation	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement provides protections for production environments. Measures such as network segmentation and access control reduce the attack surface, restrict movement by adversaries, and protect critical assets and data from compromise. References
PR.AA-01.01	Identity and credential management	Mitigates	T1098	Account Manipulation	Comments This diagnostic statement protects against Account Manipulation through the use of hardened access control policies, secure defaults, password complexity requirements, multifactor authentication requirements, and removal of terminated accounts. References

NIST 800-53 Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
CM-06	Configuration Settings	mitigates	T1098	Account Manipulation
CM-05	Access Restrictions for Change	mitigates	T1098	Account Manipulation
IA-02	Identification and Authentication (Organizational Users)	mitigates	T1098	Account Manipulation
CM-07	Least Functionality	mitigates	T1098	Account Manipulation
SI-04	System Monitoring	mitigates	T1098	Account Manipulation
AC-02	Account Management	mitigates	T1098	Account Manipulation
AC-03	Access Enforcement	mitigates	T1098	Account Manipulation
AC-04	Information Flow Enforcement	mitigates	T1098	Account Manipulation
AC-05	Separation of Duties	mitigates	T1098	Account Manipulation
AC-06	Least Privilege	mitigates	T1098	Account Manipulation
SC-07	Boundary Protection	mitigates	T1098	Account Manipulation

VERIS Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
action.hacking.variety.Backdoor	Hacking action that creates a backdoor for use.	related-to	T1098	Account Manipulation
action.hacking.vector.Backdoor	Hacking actions taken through a backdoor. C2 is only used by malware.	related-to	T1098	Account Manipulation
action.malware.variety.Backdoor	Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'.	related-to	T1098	Account Manipulation
action.malware.variety.Backdoor or C2	Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'.	related-to	T1098	Account Manipulation
attribute.integrity.variety.Modify privileges	Modified privileges or permissions	related-to	T1098	Account Manipulation

Azure Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
file_integrity_monitoring	Microsoft Defender for Cloud: File Integrity Monitoring	technique_scores	T1098	Account Manipulation	Comments This control can detect account manipulation. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/file-integrity-monitoring-overview
devops_security	Microsoft Defender for Cloud: DevOps Security	technique_scores	T1098	Account Manipulation	Comments This capability can protect against Account Manipulation by requiring DevOps best practices. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/defender-for-devops-introduction https://github.com/Azure/template-analyzer/blob/main/docs/built-in-rules.md#built-in-rules
ai_security_recommendations	Microsoft Defender for Cloud: AI Security Recommendations	technique_scores	T1098	Account Manipulation	Comments This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can prevent modifying the ssh_authorized keys file. Because it is a recommendation and limited to only one sub-technique, its score is Minimal. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/recommendations-reference-ai
alerts_for_linux_machines	Alerts for Linux Machines	technique_scores	T1098	Account Manipulation	Comments This control provides partial detection for only one of this technique's sub-techniques and does not cover most of its procedure examples, resulting in a score of Minimal. References https://learn.microsoft.com/en-us/azure/defender-for-cloud/alerts-reference#alerts-linux
azure_policy	Azure Policy	technique_scores	T1098	Account Manipulation	Comments This control can protect against account manipulation. References https://learn.microsoft.com/en-us/azure/governance/policy/overview https://learn.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir
azure_role_based_access_control	Azure Role-Based Access Control	technique_scores	T1098	Account Manipulation	Comments This control provides protection for some of this technique's sub-techniques and therefore its coverage score factor is Partial, resulting in a Partial score. References https://learn.microsoft.com/en-us/azure/role-based-access-control/overview

GCP Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
advanced_protection_program	Advanced Protection Program	technique_scores	T1098	Account Manipulation	Comments Advanced Protection Program enables the use of a security key for multi-factor authentication. This provides significant protection against unauthorized users from accessing and manipulating accounts to retain access. References ['https://landing.google.com/advancedprotection/']
cloud_asset_inventory	Cloud Asset Inventory	technique_scores	T1098	Account Manipulation	Comments This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies. This monitoring can be fine tuned to specific assets, policies, and organizations. References ['https://cloud.google.com/asset-inventory/docs/overview']
google_secops	Google Security Operations	technique_scores	T1098	Account Manipulation	Comments Google Security Ops is able to trigger an alert to ensure multi-factor authentication is enabled for all non-service and administrator accounts. This technique was scored as minimal based on low or uncertain detection coverage factor. https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_multifactor_authentication.yaral References ['https://cloud.google.com/security/products/security-operations' 'https://cloud.google.com/chronicle/docs/secops/secops-overview' 'https://github.com/chronicle/detection-rules']
identity_and_access_management	Identity and Access Management	technique_scores	T1098	Account Manipulation	Comments Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account. References ['https://cloud.google.com/iam']
identity_platform	Identity Platform	technique_scores	T1098	Account Manipulation	Comments Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels. References ['https://cloud.google.com/identity-platform/docs/concepts']
policy_intelligence	Policy Intelligence	technique_scores	T1098	Account Manipulation	Comments Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need. References ['https://cloud.google.com/policy-intelligence']
resource_manager	Resource Manager	technique_scores	T1098	Account Manipulation	Comments GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers. References ['https://cloud.google.com/resource-manager/docs/cloud-platform-resource-hierarchy']
vpc_service_controls	VPC Service Controls	technique_scores	T1098	Account Manipulation	Comments VPC further segments the environment by providing configurable granular access controls which help limit user communications to critical systems. References ['https://cloud.google.com/vpc-service-controls/docs']

AWS Mappings

Capability ID	Capability Description	Mapping Type	ATT&CK ID	ATT&CK Name	Notes
amazon_guardduty	Amazon GuardDuty	technique_scores	T1098	Account Manipulation	Comments GuardDuty has a finding types that flag events where an adversary may have compromised an AWS IAM User. Finding Type: Persistence:IAMUser/AnomalousBehavior References https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_finding-types-ec2.html#recon-ec2-portscan https://docs.aws.amazon.com/guardduty/latest/ug/guardduty_findings.html
aws_config	AWS Config	technique_scores	T1098	Account Manipulation	Comments This control provides significant coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal. References https://docs.aws.amazon.com/config https://docs.aws.amazon.com/config/latest/developerguide https://docs.aws.amazon.com/config/latest/developerguide/managed-rules-by-aws-config.html
aws_identity_and_access_management	AWS Identity and Access Management	technique_scores	T1098	Account Manipulation	Comments This control may generate logs for creation and manipulation of accounts but the relevant security information would be handled by another security control. References https://docs.aws.amazon.com/iam/index.html
aws_security_hub	AWS Security Hub	technique_scores	T1098	Account Manipulation	Comments AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the manipulation of accounts. AWS Security Hub provides this detection with the following check. 3.4 Ensure a log metric filter and alarm exist for IAM policy changes This is scored as Minimal because it only supports a subset of the sub-techniques. References https://docs.aws.amazon.com/securityhub/latest/userguide/what-is-securityhub.html

ATT&CK Subtechniques

Technique ID	Technique Name	Number of Mappings
T1098.003	Additional Cloud Roles	24
T1098.006	Additional Container Cluster Roles	17
T1098.007	Additional Local or Domain Groups	14
T1098.004	SSH Authorized Keys	26
T1098.005	Device Registration	16
T1098.001	Additional Cloud Credentials	43
T1098.002	Additional Email Delegate Permissions	20