Register to stream ATT&CKcon 2.0 October 29-30

Account Manipulation

Account manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of modifying permissions, modifying credentials, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to subvert password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.

ID: T1098
Tactic: Credential Access, Persistence
Platform: Windows
Permissions Required: Administrator
Data Sources: Authentication logs, API monitoring, Windows event logs, Packet capture
Contributors: Tim MalcomVetter
Version: 1.0

Procedure Examples

Name Description
APT3 APT3 has been known to add created accounts to local admin groups to maintain elevated access. [7]
Calisto Calisto adds permissions and remote logins to all users. [3]
Dragonfly 2.0 Dragonfly 2.0 added newly created accounts to the administrators group to maintain elevated access. [8] [9]
Lazarus Group Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account. [5] [6]
Mimikatz The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value. [1] [2]
Skeleton Key Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller. [4]


Mitigation Description
Multi-factor Authentication Use multi-factor authentication for user and privileged accounts.
Network Segmentation Configure access controls and firewalls to limit access to critical systems and domain controllers.
Operating System Configuration Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
Privileged Account Management Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.


Collect events that correlate with changes to account objects on systems and the domain, such as event ID 4738. [10] Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ [11] or that include additional flags such as changing a password without knowledge of the old password. [12]

Use of credentials may also occur at unusual times or to unusual systems or services and may correlate with other suspicious activity.