T1098 — Account Manipulation
Parent technique
Description
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
Sub-techniques
- T1098.001 — Additional Cloud Credentials
- T1098.002 — Additional Email Delegate Permissions
- T1098.003 — Additional Cloud Roles
- T1098.004 — SSH Authorized Keys
- T1098.005 — Device Registration
- T1098.006 — Additional Container Cluster Roles
- T1098.007 — Additional Local or Domain Groups
Detected by EasySIEM
This project's own SigmaHQ-derived detection pipeline tags every compiled rule with the ATT&CK technique(s) it maps to -- if a rule in your install covers this technique, it shows up automatically on your own Grafana Alerts dashboard's "Top ATT&CK Techniques" panel, no lookup needed. This page exists so a click from there always lands here on easysiem.com, not on attack.mitre.org.