Account Manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

ID: T1098
Platforms: Azure AD, Containers, Google Workspace, IaaS, Linux, Network, Office 365, SaaS, Windows, macOS
Contributors: Arad Inbar, Fidelis Security; Jannie Li, Microsoft Threat Intelligence Center (MSTIC); Praetorian; Tim MalcomVetter; Wojciech Lesicki
Version: 2.6
Created: 31 May 2017
Last Modified: 16 January 2024

Procedure Examples

ID Name Description
C0025 2016 Ukraine Electric Power Attack

During the 2016 Ukraine Electric Power Attack, Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.[2]

G0022 APT3

APT3 has been known to add created accounts to local admin groups to maintain elevated access.[3]

G0096 APT41

APT41 has added user accounts to the User and Admin groups.[4]

G1023 APT5

APT5 has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.[5]

S0274 Calisto

Calisto adds permissions and remote logins to all users.[6]

S1111 DarkGate

DarkGate elevates accounts created through the malware to the local administration group during execution.[7]

G0035 Dragonfly

Dragonfly has added newly created accounts to the administrators group to maintain elevated access.[8]

G1016 FIN13

FIN13 has assigned newly created accounts the sysadmin role to maintain persistence.[9]

G0125 HAFNIUM

HAFNIUM has granted privileges to domain accounts.[10]

G0094 Kimsuky

Kimsuky has added accounts to specific groups with net localgroup.[11]

G0032 Lazarus Group

Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.[12][13]

G0059 Magic Hound

Magic Hound has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.[14]

S0002 Mimikatz

The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The LSADUMP::ChangeNTLM and LSADUMP::SetNTLM modules can also manipulate the password hash of an account without knowing the clear text value.[15][16]

S0382 ServHelper

ServHelper has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.[17]

S0649 SMOKEDHAM

SMOKEDHAM has added user accounts to local Admin groups.[1]

Mitigations

ID Mitigation Description
M1032 Multi-factor Authentication

Use multi-factor authentication for user and privileged accounts.

M1030 Network Segmentation

Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.

M1028 Operating System Configuration

Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.

M1026 Privileged Account Management

Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.

M1018 User Account Management

Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.

Detection

ID Data Source Data Component Detects
DS0026 Active Directory Active Directory Object Modification

Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.[18]

DS0017 Command Command Execution

Monitor executed commands and arguments for suspicious commands to modify accounts or account settings (including files such as the authorized_keys or /etc/ssh/sshd_config).

Monitor executed commands and arguments of suspicious commands (such as Add-MailboxPermission) that may be indicative of modifying the permissions of Exchange and other related service settings.

DS0022 File File Modification

Monitor for changes made to files related to account settings, such as /etc/ssh/sshd_config and the authorized_keys file for each user on a system.

DS0036 Group Group Modification

Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.

DS0009 Process Process Creation

Monitor for newly constructed processes indicative of modifying account settings, such as those that modify authorized_keys or /etc/ssh/sshd_config files.

DS0002 User Account User Account Modification

Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670. Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ or that include additional flags such as changing a password without knowledge of the old password.

Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts.

References