Credential Manipulation

Jump to: navigation, search
Credential Manipulation
ID T1098
Tactic Credential Access
Platform Windows Server 2003, Windows Server 2008, Windows Server 2012, Windows XP, Windows 7, Windows 8, Windows Server 2003 R2, Windows Server 2008 R2, Windows Server 2012 R2, Windows Vista, Windows 8.1
Permissions Required Administrator
Data Sources Authentication logs, API monitoring

Account creation and manipulation may aid adversaries in maintaining access to credentials and certain permission levels within an environment. Manipulation could consist of creating new credentials, modifying permissions, adding or changing permission groups, modifying account settings, or modifying how authentication is performed. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain.


  • Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.1
  • The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality.2
  • Skeleton Key is used to patch an enterprise domain controller authentication process with a backdoor password. It allows adversaries to bypass the standard authentication system to use a defined password for all accounts authenticating to that domain controller.3
  • Mis-Type may create a temporary user on the system named “Lost_{Unique Identifier}.”4
  • S-Type may create a temporary user on the system named “Lost_{Unique Identifier}” with the password “pond~!@6”{Unique Identifier}.”4
  • Flame can create backdoor accounts with the login "HelpAssistant" with the Limbo module.5


Use multifactor authentication. Follow guidelines to prevent or limit adversary access to Legitimate Credentials.

Protect domain controllers by ensuring proper security configuration for critical servers. Configure access controls and firewalls to limit access to these systems. Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.


Monitor for creation or modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems.

Use of credentials may also occur at unusual times or to unusual systems or services and may correlate with other suspicious activity.