Skip to content

T1098 Account Manipulation

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Item Value
ID T1098
Sub-techniques T1098.001, T1098.002, T1098.003, T1098.004, T1098.005
Tactics TA0003
Platforms Azure AD, Google Workspace, IaaS, Linux, Network, Office 365, SaaS, Windows, macOS
Version 2.5
Created 31 May 2017
Last Modified 12 April 2023

Procedure Examples

ID Name Description
C0025 2016 Ukraine Electric Power Attack During the 2016 Ukraine Electric Power Attack, Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.18
G0022 APT3 APT3 has been known to add created accounts to local admin groups to maintain elevated access.16
G0096 APT41 APT41 has added user accounts to the User and Admin groups.13
S0274 Calisto Calisto adds permissions and remote logins to all users.7
G0035 Dragonfly Dragonfly has added newly created accounts to the administrators group to maintain elevated access.17
G0125 HAFNIUM HAFNIUM has granted privileges to domain accounts.11
G0094 Kimsuky Kimsuky has added accounts to specific groups with net localgroup.12
G0032 Lazarus Group Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.1514
G0059 Magic Hound Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.10
S0002 Mimikatz The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.56
S0382 ServHelper ServHelper has added a user named “supportaccount” to the Remote Desktop Users and Administrators groups.9
S0649 SMOKEDHAM SMOKEDHAM has added user accounts to local Admin groups.8

Mitigations

ID Mitigation Description
M1032 Multi-factor Authentication Use multi-factor authentication for user and privileged accounts.
M1030 Network Segmentation Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
M1028 Operating System Configuration Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
M1026 Privileged Account Management Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
M1018 User Account Management Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.

Detection

ID Data Source Data Component
DS0026 Active Directory Active Directory Object Modification
DS0017 Command Command Execution
DS0022 File File Modification
DS0036 Group Group Modification
DS0009 Process Process Creation
DS0002 User Account User Account Modification

References

  1. Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019. ↩

  2. Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017. ↩

  3. Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017. ↩

  4. Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017. ↩

  5. Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015. ↩

  6. Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015. ↩

  7. Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018. ↩

  8. FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021. ↩

  9. Schwarz, D. and Proofpoint Staff. (2019, January 9). ServHelper and FlawedGrace - New malware introduced by TA505. Retrieved May 28, 2019. ↩

  10. DFIR Report. (2022, March 21). APT35 Automates Initial Access Using ProxyShell. Retrieved May 25, 2022. ↩

  11. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩

  12. KISA. (n.d.). Phishing Target Reconnaissance and Attack Resource Analysis Operation Muzabi. Retrieved March 7, 2022. ↩

  13. Fraser, N., et al. (2019, August 7). Double DragonAPT41, a dual espionage and cyber crime operation APT41. Retrieved September 23, 2019. ↩

  14. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved March 2, 2016. ↩

  15. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩

  16. valsmith. (2012, September 21). More on APTSim. Retrieved September 28, 2017. ↩

  17. US-CERT. (2018, March 16). Alert (TA18-074A): Russian Government Cyber Activity Targeting Energy and Other Critical Infrastructure Sectors. Retrieved June 6, 2018. ↩

  18. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020. ↩

  19. Microsoft. (2020, September 16). Azure Active Directory security operations for devices. Retrieved February 21, 2023. ↩