t1098-account-manipulation

name	T1098_account-manipulation
description	Adversaries may manipulate accounts to maintain and/or elevate access to victim systems.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1098","persistence","privilege-escalation","containers","esxi","iaas","identity-provider","linux","macos","network-devices","office-suite","saas","windows"]
technique_id	T1098
tactic	persistence
all_tactics	["persistence","privilege-escalation"]
platforms	["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"]
mitre_url	https://attack.mitre.org/techniques/T1098
tech_stack	["containers","esxi","cloud","identity","linux","macos","network devices","office","saas","windows"]
cwe_ids	["CWE-276"]
chains_with	["T1098.001","T1098.002","T1098.003","T1098.004","T1098.005","T1098.006","T1098.007"]
prerequisites	[]
severity_boost	{"T1098.001":"Chain with T1098.001 for deeper attack path","T1098.002":"Chain with T1098.002 for deeper attack path","T1098.003":"Chain with T1098.003 for deeper attack path"}

T1098 Account Manipulation

High-Level Description

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Kill Chain Phase

• Persistence (TA0003)
• Privilege Escalation (TA0004)

Platforms: Containers, ESXi, IaaS, Identity Provider, Linux, macOS, Network Devices, Office Suite, SaaS, Windows

What to Check

• Identify if Account Manipulation technique is applicable to target environment
• Check Containers systems for indicators of Account Manipulation
• Check ESXi systems for indicators of Account Manipulation
• Check IaaS systems for indicators of Account Manipulation
• Verify mitigations are bypassed or absent (7 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Admin Account Manipulate

Manipulate Admin Account Name

Supported Platforms: windows Elevation Required: Yes

$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHa_$x$y$z

$fmm = Get-LocalGroupMember -Group Administrators |?{ $_.ObjectClass -match "User" -and $_.PrincipalSource -match "Local"} | Select Name

foreach($member in $fmm) {
    if($member -like "*Administrator*") {
        $account = $member.Name.Split("\")[-1] # strip computername\
        $originalDescription = (Get-LocalUser -Name $account).Description
        Set-LocalUser -Name $account -Description "atr:$account;$originalDescription".Substring(0,48) # Keep original name in description
        Rename-LocalUser -Name $account -NewName "HaHa_$x$y$z" # Required due to length limitation
        Write-Host "Successfully Renamed $account Account on " $Env:COMPUTERNAME
        }
    }