Description
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
Platforms
Sub-Techniques (7)
Additional Cloud Credentials
T1098.002Additional Email Delegate Permissions
T1098.003Additional Cloud Roles
T1098.004SSH Authorized Keys
T1098.005Device Registration
T1098.006Additional Container Cluster Roles
T1098.007Additional Local or Domain Groups
Mitigations (7)
Network SegmentationM1030
Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
Disable or Remove Feature or ProgramM1042
Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.
User Account ManagementM1018
Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.
Restrict File and Directory PermissionsM1022
Restrict access to potentially sensitive files that deal with authentication and/or authorization.
Multi-factor AuthenticationM1032
Use multi-factor authentication for user and privileged accounts.
Privileged Account ManagementM1026
Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
Operating System ConfigurationM1028
Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
Threat Groups (4)
| ID | Group | Context |
|---|---|---|
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s accoun... |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) has added accounts to the ESX Admins group to grant them full admin rights in vSphere.(Citat... |
| G1055 | VOID MANTICORE | [VOID MANTICORE](https://attack.mitre.org/groups/G1055) has leveraged access to administrative control systems to achieve disruptive effects, consiste... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has granted privileges to domain accounts and reset the password for default admin accounts.(Citation... |
Associated Software (3)
| ID | Name | Type | Context |
|---|---|---|---|
| S0002 | Mimikatz | Tool | The [Mimikatz](https://attack.mitre.org/software/S0002) credential dumper has been extended to include Skeleton Key domain controller authentication b... |
| S9008 | Shai-Hulud | Malware | [Shai-Hulud](https://attack.mitre.org/software/S9008) has modified GitHub account settings for private repositories and changed them to public.(Citati... |
| S0274 | Calisto | Malware | [Calisto](https://attack.mitre.org/software/S0274) adds permissions and remote logins to all users.(Citation: Symantec Calisto July 2018) |
References
- FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.
- Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.
- Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.
- Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.
- Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.
Frequently Asked Questions
What is T1098 (Account Manipulation)?
T1098 is a MITRE ATT&CK technique named 'Account Manipulation'. It belongs to the Persistence, Privilege Escalation tactic(s). Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised acc...
How can T1098 be detected?
Detection of T1098 (Account Manipulation) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1098?
There are 7 documented mitigations for T1098. Key mitigations include: Network Segmentation, Disable or Remove Feature or Program, User Account Management, Restrict File and Directory Permissions, Multi-factor Authentication.
Which threat groups use T1098?
Known threat groups using T1098 include: Lazarus Group, Scattered Spider, VOID MANTICORE, HAFNIUM.