Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
|C0025||2016 Ukraine Electric Power Attack||
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the
APT3 has been known to add created accounts to local admin groups to maintain elevated access.
APT41 has added user accounts to the User and Admin groups.
Dragonfly has added newly created accounts to the administrators group to maintain elevated access.
Kimsuky has added accounts to specific groups with
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.
Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.
The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The
ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.
SMOKEDHAM has added user accounts to local Admin groups.
Use multi-factor authentication for user and privileged accounts.
Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
|M1028||Operating System Configuration||
Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
|M1026||Privileged Account Management||
Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
|M1018||User Account Management||
Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.
|ID||Data Source||Data Component||Detects|
|DS0026||Active Directory||Active Directory Object Modification||
Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.
Monitor executed commands and arguments for suspicious commands to modify accounts or account settings (including files such as the
Monitor executed commands and arguments of suspicious commands (such as
Monitor for changes made to files related to account settings, such as
Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.
Monitor for newly constructed processes indicative of modifying account settings, such as those that modify
|DS0002||User Account||User Account Modification||
Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670. Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ or that include additional flags such as changing a password without knowledge of the old password.
Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts.