Applied Cybernetics Group
T1098 Account Manipulation
- Technique
T1098- Tactics
- Persistence, Privilege Escalation
- Research, 90 days
- 1
- KEV CVEs mapped
- 2
- SigmaHQ rules
- 32
- Elastic, Splunk
- 241
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1098
MITRE description
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
KEV CVEs mapped to this technique
MITRE CTID maps these KEV CVEs to this technique by hand. They are the actively exploited vulnerabilities behind this technique's KEV signal.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-29Cisco Talos: IR trends Q3 2026: Actors impersonate IT help desks in vishing attacks as ransomware activity increases
Detection coverage
SigmaHQ community rules
- Suspicious Computer Account Name Change CVE-2021-42287 (emerging-threats)
- Bitbucket Global Permission Changed (core)
- AWS IAM Backdoor Users Keys (core)
- AWS Route 53 Domain Transfer Lock Disabled (core)
- AWS Route 53 Domain Transferred to Another Account (core)
- AWS User Login Profile Was Modified (core)
- Number Of Resource Creation Or Deployment Activities (core)
- Change to Authentication Method (core)
- Bulk Deletion Changes To Privileged Account Permissions (core)
- Anomalous User Activity (core)
- GCP Access Policy Deleted (core)
- Google Workspace Granted Domain API Access (core)
- Google Workspace User Granted Admin Privileges (core)
- Privileged User Has Been Created (core)
- ESXi Admin Permission Assigned To Account Via ESXCLI (core)
- Cisco Local Accounts (core)
- A Member Was Added to a Security-Enabled Global Group (core)
- A Member Was Removed From a Security-Enabled Global Group (core)
- A Security-Enabled Global Group Was Deleted (core)
- Powerview Add-DomainObjectAcl DCSync AD Extend Right (core)
- Enabled User Right in AD to Control User Objects (core)
- Active Directory User Backdoors (core)
- A New Trust Was Created To A Domain (core)
- Password Change on Directory Service Restore Mode (DSRM) Account (core)
- User Added to Local Administrator Group (core)
Showing 25 of 32 community rules.
the full set is tagged attack.t1098 in
SigmaHQ.
Elastic and Splunk rules
- SSH Authorized Keys File Activity (elastic)
- Anthropic Admin API Key Created (elastic)
- Anthropic Admin Role Assigned to User (elastic)
- Anthropic Compliance API Key Created (elastic)
- Anthropic Organization Domain Boundary Changed (elastic)
- Anthropic Sensitive Claude Project Role Assigned to User (elastic)
- Anthropic Primary Owner Transferred (elastic)
- AWS IAM User Addition to Group (elastic)
- AWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity (elastic)
- AWS First Occurrence of STS GetFederationToken Request by User (elastic)
- AWS S3 Bucket Policy Added to Share with External Account (elastic)
- AWS EC2 Instance Connect SSH Public Key Uploaded (elastic)
- AWS IAM Virtual MFA Device Registration Attempt with Session Token (elastic)
- AWS Bedrock Unauthorized Foundation Model Access Attempt (elastic)
- AWS Bedrock Foundation Model Access Enabled or Entitlement Granted (elastic)
- AWS Bedrock Unauthorized Resource-Based Policy Modification Attempt (elastic)
- AWS Bedrock Resource-Based Policy Modified or Deleted (elastic)
- AWS EKS Cluster-Admin Role Binding Created (elastic)
- AWS EKS Access Entry Created Then Deleted by Same Identity (elastic)
- AWS EKS Access Entry Modified (elastic)
- AWS IAM API Calls via Temporary Session Tokens (elastic)
- AWS IAM Login Profile Added for Root (elastic)
- AWS IAM Login Profile Created or Modified for an IAM User (elastic)
- AWS IAM Roles Anywhere Profile Creation (elastic)
- AWS IAM Roles Anywhere Trust Anchor Created with External CA (elastic)
Showing 25 of 241.