{
  "technique_id": "T1098",
  "name": "Account Manipulation",
  "tactics": [
    "Persistence",
    "Privilege Escalation"
  ],
  "platforms": [
    "Windows",
    "Azure AD",
    "Office 365",
    "SaaS"
  ],
  "summary": "Adversaries may manipulate accounts — adding credentials, changing permissions, adding delegates or forwarding rules, or modifying group memberships — to maintain persistent access after an initial compromise.\n",
  "generated_by": "SOC Response Atlas by Basyrix"
}