1. Home
  2. ATT&CK Techniques
  3. T1098 Account Manipulation

T1098 Account Manipulation Mappings

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

View in MITRE ATT&CK®

Mappings

Capability ID Capability Description Mapping Type ATT&CK ID ATT&CK Name Notes
AC-2 Account Management Protects T1098 Account Manipulation
AC-3 Access Enforcement Protects T1098 Account Manipulation
AC-4 Information Flow Enforcement Protects T1098 Account Manipulation
AC-5 Separation of Duties Protects T1098 Account Manipulation
AC-6 Least Privilege Protects T1098 Account Manipulation
CM-5 Access Restrictions for Change Protects T1098 Account Manipulation
CM-6 Configuration Settings Protects T1098 Account Manipulation
CM-7 Least Functionality Protects T1098 Account Manipulation
IA-2 Identification and Authentication (organizational Users) Protects T1098 Account Manipulation
SC-46 Cross Domain Policy Enforcement Protects T1098 Account Manipulation
SC-7 Boundary Protection Protects T1098 Account Manipulation
SI-4 System Monitoring Protects T1098 Account Manipulation
azure_security_center_recommendations Azure Security Center Recommendations technique_scores T1098 Account Manipulation
Comments
This control's "Immutable (read-only) root filesystem should be enforced for containers" recommendation can prevent modifying the ssh_authorized keys file. Because it is a recommendation and limited to only one sub-technique, its score is Minimal.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/recommendations-reference
  2. https://docs.microsoft.com/en-us/azure/security-center/security-center-introduction
linux_auditd_alerts_and_log_analytics_agent_integration Linux auditd alerts and Log Analytics agent integration technique_scores T1098 Account Manipulation
Comments
This control provides partial detection for only one of this technique's sub-techniques and does not cover most of its procedure examples, resulting in a score of Minimal.
References
  1. https://docs.microsoft.com/en-us/azure/security-center/defender-for-servers-introduction
  2. https://docs.microsoft.com/en-us/azure/security-center/alerts-reference#alerts-linux
azure_sentinel Azure Sentinel technique_scores T1098 Account Manipulation
Comments
The following Azure Sentinel Hunting queries can identify potentially malicious manipulation of accounts to increase or maintain access: "Azure DevOps - Guest users access enabled", "Azure DevOps - Additional Org Admin added", "Anomalous Activity Role Assignment", "Anomalous Role Assignment", and "Anomalous AAD Account Manipulation", which indicate expansion of accounts' access/privileges; "Bots added to multiple teams" which indicates workspace access granted to automated accounts. The following Azure Sentinel Analytics queries can identify potentially malicious manipulation of accounts to increase or maintain access: "Suspicious granting of permissions to an account" from a previously unobserved IP address, "External user added and removed in short timeframe" for Teams resources, "Account added and removed from privileged group", "User account added to built in domain local or global group", and "New user created and added to the built-in administrator group". "Multiple Password Reset by user" can detect potentially malicious iterative password resets.
References
  1. https://docs.microsoft.com/en-us/azure/sentinel/overview
  2. https://docs.microsoft.com/en-us/azure/sentinel/hunting
microsoft_defender_for_identity Microsoft Defender for Identity technique_scores T1098 Account Manipulation
Comments
This controls's "Suspicious additions to sensitive groups (external ID 2024)" alert can utilize machine learning to detect when an attacker adds users to highly privileged groups. Adding users is done to gain access to more resources, and gain persistency. This detection relies on profiling the group modification activities of users, and alerting when an abnormal addition to a sensitive group is observed. Defender for Identity profiles continuously. This alert provides Partial coverage of this technique with a reduced false-positive rate by utilizing machine learning models.
References
  1. https://docs.microsoft.com/en-us/defender-for-identity/what-is
role_based_access_control Role Based Access Control technique_scores T1098 Account Manipulation
Comments
This control provides protection for some of this technique's sub-techniques and therefore its coverage score factor is Partial, resulting in a Partial score.
References
  1. https://docs.microsoft.com/en-us/azure/role-based-access-control/overview
file_integrity_monitoring File Integrity Monitoring technique_scores T1098 Account Manipulation
Comments
References
  1. https://docs.microsoft.com/en-us/azure/security-center/security-center-file-integrity-monitoring
azure_policy Azure Policy technique_scores T1098 Account Manipulation
Comments
References
  1. https://docs.microsoft.com/en-us/azure/governance/policy/overview
  2. https://docs.microsoft.com/en-us/azure/governance/policy/samples/built-in-policies#api-for-fhir
azure_ad_privileged_identity_management Azure AD Privileged Identity Management technique_scores T1098 Account Manipulation
Comments
This control provides significant protection for some of this technique's sub-techniques while not providing any protection for others, resulting in a Partial score.
References
  1. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
azure_ad_privileged_identity_management Azure AD Privileged Identity Management technique_scores T1098 Account Manipulation
Comments
This control only provides detection for one of this technique's sub-techniques while not providing any detection for the remaining and therefore its coverage score is Minimal, resulting in a Minimal score.
References
  1. https://docs.microsoft.com/en-us/azure/active-directory/privileged-identity-management/pim-configure
cloud_app_security_policies Cloud App Security Policies technique_scores T1098 Account Manipulation
Comments
This control can detect anomalous admin activity that may be indicative of account manipulation. Relevant alerts include "Unusual administrative activity (by user)" and "Unusual addition of credentials to an OAuth app".
References
  1. https://docs.microsoft.com/en-us/cloud-app-security/policies-cloud-discovery
  2. https://docs.microsoft.com/en-us/cloud-app-security/policies-information-protection
  3. https://docs.microsoft.com/en-us/cloud-app-security/investigate-anomaly-alerts

ATT&CK Subtechniques

Technique ID Technique Name Number of Mappings
T1098.003 Add Office 365 Global Administrator Role 15
T1098.002 Exchange Email Delegate Permissions 12
T1098.004 SSH Authorized Keys 12
T1098.001 Additional Cloud Credentials 20