Account Manipulation

What is Account Manipulation?

“Account Manipulation is documented as technique T1098 in MITRE ATT&CK® v19.1 under the Persistence tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Account Manipulation activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for changes to user account attributes in Active Directory including SIDHistory modifications, AdminSDHolder changes, and group membership modifications for sensitive groups.

2. 2

   Track password reset and credential modification events, particularly for privileged accounts, service accounts, and accounts that have recently been involved in suspicious authentication activity.

3. 3

   Alert on enrollment of new MFA methods or authentication devices for accounts that were not previously enrolled, as attackers may add their own authentication factors to maintain access after password changes.

4. 4

   Monitor cloud platform audit logs for IAM permission changes, role policy modifications, and service principal credential additions that were not authorized through change management processes.

5. 5

   Detect SSH authorized_key file modifications on Linux servers and workstations, as attackers frequently add their own public keys to maintain persistent SSH access even after password-based credentials are changed.

Example Alerts

These realistic alert examples show what Account Manipulation looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Account Manipulation?

Detection centers on SIEM, XDR telemetry for the persistence phase of the attack. Monitor for changes to user account attributes in Active Directory including SIDHistory modifications, AdminSDHolder changes, and group membership modifications for sensitive groups. Track password reset and credential modification events, particularly for privileged accounts, service accounts, and accounts that have recently been involved in suspicious authentication activity.

What does a Account Manipulation alert look like?

A representative SIEM detection is "MFA Device Enrolled for Administrator Account" (high severity): New MFA device enrolled for account admin_jbaker from an IP address in Russia. The account owner has not submitted a helpdesk ticket for MFA enrollment and was not scheduled for a device upgrade. The enrolling IP has no prior authentication history for this account and appears on threat intelligence as associated with APT infrastructure.

Which tools detect Account Manipulation, and how can I practice?

Account Manipulation (T1098) is best surfaced with SIEM, XDR telemetry, which exposes the persistence signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.