Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| action.hacking.variety.Backdoor | Hacking action that creates a backdoor for use. | related-to | T1098 | Account Manipulation | |
| action.hacking.vector.Backdoor | Hacking actions taken through a backdoor. C2 is only used by malware. | related-to | T1098 | Account Manipulation | |
| action.malware.variety.Backdoor | Malware creates a backdoor capability for hacking. Child of 'RAT' when combined with 'Trojan'. Child of 'Backdoor or C2'. | related-to | T1098 | Account Manipulation | |
| action.malware.variety.Backdoor or C2 | Malware creates a remote control capability, but it's unclear if it's a backdoor for hacking or C2 for malware. Parent of 'C2' and 'Backdoor'. | related-to | T1098 | Account Manipulation | |
| attribute.integrity.variety.Modify privileges | Modified privileges or permissions | related-to | T1098 | Account Manipulation | |
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1098 | Account Manipulation |
Comments
GuardDuty has a finding types that flag events where an adversary may have compromised an AWS IAM User. Finding Type: Persistence:IAMUser/AnomalousBehavior
References
|
| aws_config | AWS Config | technique_scores | T1098 | Account Manipulation |
Comments
This control provides significant coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal.
References
|
| aws_identity_and_access_management | AWS Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
This control may generate logs for creation and manipulation of accounts but the relevant security information would be handled by another security control.
References
|
| aws_security_hub | AWS Security Hub | technique_scores | T1098 | Account Manipulation |
Comments
AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the manipulation of accounts. AWS Security Hub provides this detection with the following check.
3.4 Ensure a log metric filter and alarm exist for IAM policy changes
This is scored as Minimal because it only supports a subset of the sub-techniques.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1098.003 | Additional Cloud Roles | 1 |
| T1098.006 | Additional Container Cluster Roles | 2 |
| T1098.007 | Additional Local or Domain Groups | 2 |
| T1098.004 | SSH Authorized Keys | 2 |
| T1098.005 | Device Registration | 2 |
| T1098.001 | Additional Cloud Credentials | 5 |
| T1098.002 | Additional Email Delegate Permissions | 1 |