{
  "type": "attack-pattern",
  "spec_version": "2.1",
  "id": "attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27",
  "created": "2017-05-31T21:31:12.196Z",
  "created_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "revoked": false,
  "external_references": [
    {
      "source_name": "mitre-attack",
      "url": "https://attack.mitre.org/techniques/T1098",
      "external_id": "T1098"
    },
    {
      "source_name": "FireEye SMOKEDHAM June 2021",
      "description": "FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.",
      "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
    },
    {
      "source_name": "Microsoft Security Event 4670",
      "description": "Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.",
      "url": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670"
    },
    {
      "source_name": "Microsoft User Modified Event",
      "description": "Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738"
    },
    {
      "source_name": "InsiderThreat ChangeNTLM July 2017",
      "description": "Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.",
      "url": "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM"
    },
    {
      "source_name": "GitHub Mimikatz Issue 92 June 2017",
      "description": "Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.",
      "url": "https://github.com/gentilkiwi/mimikatz/issues/92"
    }
  ],
  "object_marking_refs": [
    "marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168"
  ],
  "modified": "2026-05-12T15:12:00.706Z",
  "name": "Account Manipulation",
  "description": "Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).",
  "kill_chain_phases": [
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "persistence"
    },
    {
      "kill_chain_name": "mitre-attack",
      "phase_name": "privilege-escalation"
    }
  ],
  "x_mitre_attack_spec_version": "3.3.0",
  "x_mitre_contributors": [
    "Jannie Li, Microsoft Threat Intelligence Center (MSTIC)",
    "Praetorian",
    "Tim MalcomVetter",
    "Wojciech Lesicki",
    "Arad Inbar, Fidelis Security"
  ],
  "x_mitre_deprecated": false,
  "x_mitre_domains": [
    "enterprise-attack"
  ],
  "x_mitre_is_subtechnique": false,
  "x_mitre_modified_by_ref": "identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5",
  "x_mitre_platforms": [
    "Containers",
    "ESXi",
    "IaaS",
    "Identity Provider",
    "Linux",
    "macOS",
    "Network Devices",
    "Office Suite",
    "SaaS",
    "Windows"
  ],
  "x_mitre_version": "2.8"
}