MITRE ATT&CK  /  T1098

T1098

Account Manipulation

Description

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

Platforms

Mitigations

• M1030 — Network Segmentation
• M1042 — Disable or Remove Feature or Program
• M1018 — User Account Management
• M1022 — Restrict File and Directory Permissions
• M1032 — Multi-factor Authentication
• M1026 — Privileged Account Management
• M1028 — Operating System Configuration

Our coverage

• PRC State-Sponsored Telecom Router Compromise Detection: CISA AA25-239a Breakdown
• Ruby Gem Supply Chain Attack Detection: CI Checklist for Sleeper Packages
• DPRK npm Malware Detection: Auditing npm for AI-Generated Backdoors

Source: MITRE ATT&CK Enterprise matrix. View on attack.mitre.org →