Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| advanced_protection_program | Advanced Protection Program | technique_scores | T1098 | Account Manipulation |
Comments
Advanced Protection Program enables the use of a security key for multi-factor authentication. This provides significant protection against unauthorized users from accessing and manipulating accounts to retain access.
References
|
| cloud_asset_inventory | Cloud Asset Inventory | technique_scores | T1098 | Account Manipulation |
Comments
This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies. This monitoring can be fine tuned to specific assets, policies, and organizations.
References
|
| google_secops | Google Security Operations | technique_scores | T1098 | Account Manipulation |
Comments
Google Security Ops is able to trigger an alert to ensure multi-factor authentication is enabled for all non-service and administrator accounts.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_multifactor_authentication.yaral
References
|
| identity_and_access_management | Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account.
References
|
| identity_platform | Identity Platform | technique_scores | T1098 | Account Manipulation |
Comments
Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels.
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1098 | Account Manipulation |
Comments
Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.
References
|
| resource_manager | Resource Manager | technique_scores | T1098 | Account Manipulation |
Comments
GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers.
References
|
| vpc_service_controls | VPC Service Controls | technique_scores | T1098 | Account Manipulation |
Comments
VPC further segments the environment by providing configurable granular access controls which help limit user communications to critical systems.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1098 | Account Manipulation |
Comments
GuardDuty has a finding types that flag events where an adversary may have compromised an AWS IAM User. Finding Type: Persistence:IAMUser/AnomalousBehavior
References
|
| aws_config | AWS Config | technique_scores | T1098 | Account Manipulation |
Comments
This control provides significant coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal.
References
|
| aws_identity_and_access_management | AWS Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
This control may generate logs for creation and manipulation of accounts but the relevant security information would be handled by another security control.
References
|
| aws_security_hub | AWS Security Hub | technique_scores | T1098 | Account Manipulation |
Comments
AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the manipulation of accounts. AWS Security Hub provides this detection with the following check.
3.4 Ensure a log metric filter and alarm exist for IAM policy changes
This is scored as Minimal because it only supports a subset of the sub-techniques.
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1098.003 | Additional Cloud Roles | 2 |
| T1098.006 | Additional Container Cluster Roles | 3 |
| T1098.007 | Additional Local or Domain Groups | 2 |
| T1098.004 | SSH Authorized Keys | 3 |
| T1098.005 | Device Registration | 3 |
| T1098.001 | Additional Cloud Credentials | 14 |
| T1098.002 | Additional Email Delegate Permissions | 2 |