{ "technique_id": "T1098", "name": "Account Manipulation", "priority": "high", "status": "complete", "version": "0.1.0", "last_reviewed": "2026-07-23", "generated_by": "SOC Response Atlas by Basyrix", "tactics": [ "Persistence", "Privilege Escalation" ], "platforms": [ "Windows", "Azure AD", "Office 365", "SaaS" ], "summary": "Adversaries may manipulate accounts — adding credentials, changing permissions, adding delegates or forwarding rules, or modifying group memberships — to maintain persistent access after an initial compromise.\n", "soc_recommendation": "Any unexpected credential, permission, or delegation change on an account should be treated as a potential persistence mechanism established after compromise, especially when it grants broader access or a secondary path back into the account.\n", "d3fend_mappings": [ { "id": "D3-DAM", "name": "Domain Account Monitoring", "relationship": "detect", "practical_action": "Review role assignments, group membership changes, and OAuth app consent grants for the account.\n", "tooling": [ "Entra ID", "AuditLogs" ] }, { "id": "D3-CR", "name": "Credential Revocation", "relationship": "evict", "practical_action": "Reset credentials and remove any added authentication methods.", "tooling": [ "Entra ID" ] }, { "id": "D3-MFA", "name": "Multi-factor Authentication", "relationship": "harden", "practical_action": "Confirm MFA is enforced and no unrecognized authentication method was added.", "tooling": [ "Entra ID", "Entra ID" ] } ], "investigation_steps": { "microsoft": [ "Is the path in a temp folder, %APPDATA%, %PROGRAMDATA%, or C:\\Users? → Almost certainly malicious", "Is the binary signed? Submit the hash to VirusTotal", "Does the path contain a strange name (random characters, looks like a legitimate system file)?" ], "generic": [ "Identify what changed (permission, credential, delegation, group membership) and who initiated it.", "Determine whether the change was authorized through a normal change process.", "Check whether the change grants broader or secondary access.", "Real detection reference: \"Service Principal Credential Added for Persistence\" -- Replaces the duplicated OAuth consent rule with a cloud-persistence detector for new credentials, secrets, or certificates added to applications/service principals." ] }, "evidence_to_collect": [ "Account affected", "Type of change (credential/permission/delegation/group)", "Initiating identity", "Timestamp of change", "Before/after state of the modified attribute" ], "response_actions": [ { "name": "Delete the malicious run key via MDE Live Response", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint" }, { "name": "Quarantine or delete the pointed binary (SHA256 block in MDE", "category": "Response", "risk": "Medium", "automation_safe": false, "approval_required": true, "tool": "Defender for Endpoint", "notes": "Quarantine or delete the pointed binary (SHA256 block in MDE custom indicators)" }, { "name": "Run full AV scan on the device", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide" }, { "name": "Check for additional persistence: scheduled tasks, services,", "category": "Response", "risk": "Low", "automation_safe": true, "approval_required": false, "tool": "See investigation guide", "notes": "Check for additional persistence: scheduled tasks, services, WMI subscriptions" }, { "name": "Trace the initiating process back to determine how the malwa", "category": "Response", "risk": "Low", "automation_safe": false, "approval_required": true, "tool": "See investigation guide", "notes": "Trace the initiating process back to determine how the malware was initially delivered" } ], "queries": { "kql": [ { "name": "GEN-PS-001 — Service Principal Credential Added for Persistence", "description": "Replaces the duplicated OAuth consent rule with a cloud-persistence detector for new credentials, secrets, or certificates added to applications/service principals. (Source: Bell Integration baseline detection library, mapped via sub-technique T1098.003.)", "query": "let lookback = 1d;\nlet credentialOperations = dynamic([\n \"Add service principal credentials\",\n \"Update service principal\",\n \"Add application\",\n \"Update application\",\n \"Add key credential to application\",\n \"Add password credential to application\",\n \"Add service principal delegated permission grant\"\n]);\nlet highRiskTerms = dynamic([\"keyCredentials\", \"passwordCredentials\", \"servicePrincipal\", \"federatedIdentityCredentials\", \"AppRoleAssignment\"]);\nAuditLogs\n| where TimeGenerated >= ago(lookback)\n| where OperationName has_any (credentialOperations)\n| extend Actor = tostring(InitiatedBy.user.userPrincipalName),\n AppDisplayName = tostring(TargetResources[0].displayName),\n TargetId = tostring(TargetResources[0].id),\n ModifiedProperties = tostring(TargetResources[0].modifiedProperties),\n Details = tostring(AdditionalDetails)\n| where ModifiedProperties has_any (highRiskTerms) or Details has_any (highRiskTerms) or OperationName has_any (\"credential\", \"permission grant\")\n| project\n TimeGenerated,\n Actor,\n AppDisplayName,\n TargetId,\n OperationName,\n Result,\n ModifiedProperties,\n Details\n| extend timestamp = TimeGenerated,\n AccountCustomEntity = Actor\n| order by TimeGenerated desc" }, { "name": "GEN-PE-001 — Rapid Privileged Role Assignments by Actor", "description": "Flags actors assigning multiple privileged roles in a short period. (Source: Bell Integration baseline detection library.)", "query": "let lookback = 1d;\nlet assignmentThreshold = 3;\nAuditLogs\n| where TimeGenerated >= ago(lookback)\n| where OperationName in~ (\"Add member to role\", \"Add eligible member to role\")\n| extend InitiatedByUPN = tostring(InitiatedBy.user.userPrincipalName)\n| extend TargetRole = tostring(TargetResources[0].displayName)\n| extend TargetUser = tostring(TargetResources[0].userPrincipalName)\n| where isnotempty(InitiatedByUPN)\n| summarize\n StartTime = min(TimeGenerated),\n EndTime = max(TimeGenerated),\n RoleAssignmentCount = count(),\n Roles = make_set(TargetRole, 20),\n TargetUsers = make_set(TargetUser, 50)\n by InitiatedByUPN\n| where RoleAssignmentCount >= assignmentThreshold\n| extend AccountName = tostring(split(InitiatedByUPN, \"@\")[0]),\n UPNSuffix = tostring(split(InitiatedByUPN, \"@\")[1])\n| project StartTime, EndTime, InitiatedByUPN, AccountName, UPNSuffix,\n RoleAssignmentCount, Roles, TargetUsers\n| extend timestamp = StartTime, AccountCustomEntity = InitiatedByUPN\n| order by RoleAssignmentCount desc" }, { "name": "979c42dd-533e-4ede-b18b-31a84ba8b3d6 — DSRM Account Abuse", "description": "This query detects an abuse of the DSRM account in order to maintain persistence and access to the organization's Active Directory. Ref: https://adsecurity.org/?p=1785' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)", "query": "Event\n| where EventLog == \"Microsoft-Windows-Sysmon/Operational\" and EventID in (13)\n| parse EventData with * 'ProcessId\">' ProcessId \"<\"* 'Image\">' Image \"<\" * 'TargetObject\">' TargetObject \"<\" * 'Details\">' Details \"<\" * 'User\">' User \"<\" * \n| where TargetObject has (\"HKLM\\\\System\\\\CurrentControlSet\\\\Control\\\\Lsa\\\\DsrmAdminLogonBehavior\") and Details == \"DWORD (0x00000002)\"\n| summarize StartTime = min(TimeGenerated), EndTime = max(TimeGenerated) by EventID, Computer, User, ProcessId, Image, TargetObject, Details, _ResourceId\n| extend HostName = tostring(split(Computer, \".\")[0]), DomainIndex = toint(indexof(Computer, '.'))\n| extend HostNameDomain = iff(DomainIndex != -1, substring(Computer, DomainIndex + 1), Computer)\n| extend AccountName = tostring(split(User, \"\\\\\")[1]), AccountNTDomain = tostring(split(User, \"\\\\\")[0])\n| extend ImageFileName = tostring(split(Image, \"\\\\\")[-1])\n| extend ImageDirectory = replace_string(Image, ImageFileName, \"\")\n| project-away DomainIndex" } ], "spl": [ { "name": "Account modification events", "description": "Review account modification events in Splunk.", "query": "index=audit action=\"account_modified\" user=\"\" earliest=-24h\n" } ], "esql": [ { "name": "696015ef-718e-40ff-ac4a-cc2ba88dbeeb — AWS IAM User Created Access Keys For Another User", "description": "(ESQL) An adversary with access to a set of compromised credentials may attempt to persist or escalate privileges by creating a new set of credentials for an existing user. This rule looks for use of the IAM `CreateAccessKey` API operation to create new programmatic access keys for another IAM user. (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "from logs-aws.cloudtrail-* metadata _id, _version, _index\n| where data_stream.dataset == \"aws.cloudtrail\"\n and event.provider == \"iam.amazonaws.com\"\n and event.action == \"CreateAccessKey\"\n and event.outcome == \"success\"\n and user.name != user.target.name\n| keep\n @timestamp,\n cloud.account.id,\n cloud.region,\n event.provider,\n event.action,\n event.outcome,\n data_stream.dataset,\n user.name,\n source.address,\n source.ip,\n user.target.name,\n user_agent.original,\n aws.cloudtrail.request_parameters,\n aws.cloudtrail.response_elements,\n aws.cloudtrail.user_identity.arn,\n aws.cloudtrail.user_identity.type,\n aws.cloudtrail.user_identity.access_key_id,\n source.geo.*,\n _id,\n _version,\n _index" }, { "name": "71159cad-f8b3-4b3c-ac6e-9cab05594670 — AWS IAM Credentials Added to a Bedrock API Key Phantom User", "description": "(ESQL) Identifies standard IAM credentials being added to an Amazon Bedrock API key phantom user, whose user name starts with \"BedrockAPIKey-\": either a long-term access key (CreateAccessKey) or a console password / login profile (CreateLoginProfile, UpdateLoginProfile)... (Source: Elastic's official detection-rules repository (Elastic License v2).)", "query": "FROM logs-aws.cloudtrail-* METADATA _id, _version, _index\n| WHERE event.provider == \"iam.amazonaws.com\"\n AND event.action IN (\"CreateAccessKey\", \"CreateLoginProfile\", \"UpdateLoginProfile\")\n AND event.outcome == \"success\"\n AND user.target.name LIKE \"BedrockAPIKey-*\"\n| KEEP _id, _version, _index, @timestamp, aws.*, cloud.*, event.*, source.*, user.*, user_agent.*" } ] }, "automation": { "safe": [ "Add recommendation as Sentinel incident comment.", "Remove a confirmed-malicious added MFA method or app consent grant.", "Create ServiceNow SecOps task." ], "approval_required": [ "Revert a role/group membership change.", "Reset credentials." ] }, "escalation_criteria": [ "Change grants privileged or admin-level access.", "Change adds a new authentication method not recognized by the user.", "Mailbox forwarding rule added to an external address.", "Change was made outside the normal change management process." ], "false_positive_considerations": [ "Software installer creating a legitimate startup entry — Add the signed installer's SHA256 to the ApprovedInstallers watchlist", "Browser or application auto-updater — Add specific installer executables to the exclusion list in the query — verify they are from known vendor paths" ], "confluence": { "title": "T1098 - Account Manipulation Response Guidance", "labels": [ "mitre", "attack", "d3fend", "secops", "basyrix" ], "sections": [ "summary", "d3fend_mappings", "investigation_steps", "response_actions", "queries", "automation", "escalation_criteria", "false_positive_considerations" ] } }