Skip to content

T1098 Account Manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.1 These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Item Value
ID T1098
Sub-techniques T1098.001, T1098.002, T1098.003, T1098.004, T1098.005, T1098.006, T1098.007
Tactics TA0003, TA0004
Platforms Containers, ESXi, IaaS, Identity Provider, Linux, Network Devices, Office Suite, SaaS, Windows, macOS
Version 2.8
Created 31 May 2017
Last Modified 24 October 2025

Procedure Examples

ID Name Description
C0025 2016 Ukraine Electric Power Attack During the 2016 Ukraine Electric Power Attack, Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.14
S0274 Calisto Calisto adds permissions and remote logins to all users.8
G0125 HAFNIUM HAFNIUM has granted privileges to domain accounts and reset the password for default admin accounts.1213
G0032 Lazarus Group Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.109
S0002 Mimikatz The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.67
G1015 Scattered Spider Scattered Spider has added accounts to the ESX Admins group to grant them full admin rights in vSphere.11

Mitigations

ID Mitigation Description
M1042 Disable or Remove Feature or Program Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.
M1032 Multi-factor Authentication Use multi-factor authentication for user and privileged accounts.
M1030 Network Segmentation Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
M1028 Operating System Configuration Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
M1026 Privileged Account Management Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
M1022 Restrict File and Directory Permissions Restrict access to potentially sensitive files that deal with authentication and/or authorization.
M1018 User Account Management Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.

References

  1. FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021. ↩

  2. Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019. ↩

  3. Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017. ↩

  4. Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017. ↩

  5. Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017. ↩

  6. Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015. ↩

  7. Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015. ↩

  8. Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018. ↩

  9. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024. ↩

  10. Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016. ↩

  11. Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025. ↩

  12. Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021. ↩

  13. Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025. ↩

  14. Joe Slowik. (2018, October 12). Anatomy of an Attack: Detecting and Defeating CRASHOVERRIDE. Retrieved December 18, 2020. ↩