Account Manipulation
- ID
- T1098
- Tactics
- TA0003 Persistence, TA0004 Privilege Escalation
- Platforms
- Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows
- Data sources
- User Account Modification, Process Creation, File Modification, Active Directory Object Modification
- Source
- attack.mitre.org
- MITRE last modified
- 12 May 2026
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
Sub-techniques (7)
- T1098.001 Additional Cloud Credentials
- T1098.002 Additional Email Delegate Permissions
- T1098.003 Additional Cloud Roles
- T1098.004 SSH Authorized Keys
- T1098.005 Device Registration
- T1098.006 Additional Container Cluster Roles
- T1098.007 Additional Local or Domain Groups
Detection
- DET0096 Account Manipulation Behavior Chain Detection
Data components: User Account Modification, Process Creation, File Modification, Active Directory Object Modification
Mitigations (7)
- M1018 User Account Management
Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.
- M1022 Restrict File and Directory Permissions
Restrict access to potentially sensitive files that deal with authentication and/or authorization.
- M1026 Privileged Account Management
Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.
- M1028 Operating System Configuration
Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.
- M1030 Network Segmentation
Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.
- M1032 Multi-factor Authentication
Use multi-factor authentication for user and privileged accounts.
- M1042 Disable or Remove Feature or Program
Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.
Groups (6)
- G0032 Lazarus Group
- G0125 HAFNIUM
- G1015 Scattered Spider
- G1055 VOID MANTICORE
- G1056 TeamPCP
- G1059 NIMBUS MANTICORE