Techniques › T1098
T1098 Account Manipulation
persistence · privilege escalation — Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
6
analytics
34
Sigma rules tagged attack.t1098
2
KEV CVEs mapped here
<p>Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.</p><p>In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2021-32030 | ASUS Routers | primary impact | Mapped | 2025-06-02 |
| CVE-2012-0767 | Adobe Flash Player | secondary impact | Mapped | 2022-06-08 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0096 Account Manipulation Behavior Chain Detection v1.0
AN0265 WindowsAccount attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.Tunable:
TimeWindowHighPrivilegeGroupListSubjectTargetMismatchAN0266 LinuxUse of native tools or scripting (e.g.,usermod,passwd,groupmod) to escalate permissions or persist access on existing users, correlated with login or process events.Tunable:SudoPathModifiedShellListAN0267 macOSModifications to user accounts viadscl,pwpolicy, or System Preferences CLI (sysadminctl) that alter user groups, enable root, or bypass MDM restrictions.Tunable:ModifiedUserListGroupMembershipChangesAN0268 Identity ProviderModifications to SSO/SAML user attributes (e.g.,isAdmin,role, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.Tunable:RoleAssignmentBaselineAPIUsageContextAN0269 ESXiAddition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.esxi:vpxavim.SessionManager.login / vim.AccountManager.createUser→ DC0066 Active Directory Object ModificationTunable:VMAdminAccountNameNetworkAccessLocationAN0270 SaaSRole escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.Tunable:SharingSensitivityLabelCrossOrgChanges
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1098
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 02122374-b74e-495c-b285-9e4da973f3d6
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Thomas Patzke
· 2019-12-03 (modified 2024-01-16) · logsource: product=windows service=security · 0255a820-e564-4e40-af2b-6ac61160335c
Addition of domains is seldom and should be verified for legitimacy.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · 02c39d30-02b5-45d2-b435-8aebfe5a8629
Detects activity when a member is removed from a security-enabled global group
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
Detects when an API access service account is granted domain authority.
Author: toffeebr33k
· 2021-08-09 (modified 2024-04-26) · logsource: product=aws service=cloudtrail · 055fb148-60f8-462d-ad16-26926ce050f1
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Author: faloker
· 2020-02-12 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=process_creation · 0ea8db81-2ff6-4525-9448-33bbe7effc13
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-05 · logsource: product=azure service=auditlogs · 102e11e3-2db5-4c9e-bc26-357d42585d21
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-02-23 · logsource: product=windows category=process_creation · 10fb649c-3600-4d37-b1e6-56ea90bb7e09
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 258b6593-215d-4a26-a141-c8e31c1299a6
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
· 2019-04-03 (modified 2022-08-16) · logsource: product=windows service=security · 2c99737c-585d-4431-b61a-c911d86ff32f
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 2d1b83e4-17c6-4896-a37b-29140b40a788
Detects when an Google Workspace user is granted admin privileges.
Author: @neu5ron
· 2017-04-13 (modified 2024-02-26) · logsource: product=windows service=security · 300bac00-e041-4ee2-9c36-e262656a6ecc
Detects scenarios where one can control another users or computers account without having to use their credentials.
Author: @neu5ron
· 2017-07-30 (modified 2021-12-02) · logsource: product=windows service=security · 311b6ce2-7890-4383-a8c2-663a9f6b43cd
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 32438676-1dba-4ac7-bf69-b86cba995e05
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 3940b5f1-3f46-44aa-b746-ebe615b879e0
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Author: Florian Roth (Nextron Systems)
· 2021-12-22 (modified 2022-12-25) · logsource: product=windows service=security · 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: frack113
· 2021-12-28 · logsource: product=windows category=ps_script · 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Author: Thomas Patzke
· 2017-02-19 (modified 2020-08-23) · logsource: product=windows service=security · 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · 6c9eb492-e477-4df9-b0f4-571fc9db29cd
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Daniel Koifman (KoifSec)
· 2025-07-30 · logsource: product=windows category=process_creation · 7864a175-3654-4824-9f0d-f0da18ab27c0
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-04 · logsource: product=linux category=process_creation · 9691f58d-92c1-4416-8bf3-2edd753ec9cf
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 9b111d8e-92e0-4153-88bc-daefc1333aba
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · aac6c4f4-87c7-4961-96ac-c3fd3a42c310
Detects global permissions change activity.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-08-12 (modified 2023-03-02) · logsource: product=windows category=process_creation · ad720b90-25ad-43ff-9b5e-5c841facc8e5
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b056de1a-6e6e-4e40-a67e-97c9808cf41b
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · b237c54b-0f15-4612-a819-44b735e0de27
Detects activity when a security-enabled global group is deleted
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · c43c26be-2e87-46c7-8661-284588c5a53e
Detects activity when a member is added to a security-enabled global group
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · d2d901db-7a75-45a1-bc39-0cbf00812192
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · e15bc294-ae2a-45ad-b7d6-637b33868bde
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.