Account Manipulation

What is Account Manipulation?

Adversaries may manipulate accounts to maintain or improve access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials, cloning accounts, or granting additional permissions. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password history requirements or enrolling additional authentication methods to bypass multi-factor authentication. Adversaries may also modify account attributes to avoid detection, such as changing the display name, email address, or group membership of compromised accounts. In cloud environments, account manipulation often targets IAM roles, service principals, and OAuth application permissions to establish persistent access pathways that survive credential rotations.

“Account Manipulation is documented as technique T1098 in the MITRE ATT&CK knowledge base under the Persistence tactic. Detection requires visibility into SIEM, XDR telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify Account Manipulation activity. These methods apply across SIEM, XDR environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for changes to user account attributes in Active Directory including SIDHistory modifications, AdminSDHolder changes, and group membership modifications for sensitive groups.

2. 2

   Track password reset and credential modification events, particularly for privileged accounts, service accounts, and accounts that have recently been involved in suspicious authentication activity.

3. 3

   Alert on enrollment of new MFA methods or authentication devices for accounts that were not previously enrolled, as attackers may add their own authentication factors to maintain access after password changes.

4. 4

   Monitor cloud platform audit logs for IAM permission changes, role policy modifications, and service principal credential additions that were not authorized through change management processes.

5. 5

   Detect SSH authorized_key file modifications on Linux servers and workstations, as attackers frequently add their own public keys to maintain persistent SSH access even after password-based credentials are changed.

Example Alerts

These realistic alert examples show what Account Manipulation looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect Account Manipulation?

SOC analysts detect Account Manipulation (T1098) by monitoring SIEM, XDR telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for changes to user account attributes in active directory including sidhistory modifications, adminsdholder changes, and group membership mod. SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect Account Manipulation?

Account Manipulation can be detected using SIEM, XDR platforms. SIEM tools are particularly effective for this technique because they provide visibility into the persistence phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is Account Manipulation in real-world attacks?

Account Manipulation is a well-documented MITRE ATT&CK technique in the Persistence tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic Account Manipulation scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting Account Manipulation for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Persistence techniques like Account Manipulation. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.