T1098: Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
Analyst context for executives and security teams
Account Manipulation matters because it turns an initial compromise into durable access. If an attacker can change passwords, add credentials, alter group membership, register devices, delegate mailbox access, or assign cloud/container roles, the incident may survive password resets and appear as legitimate account activity. For leaders, this is an identity-control and recovery-readiness issue across Windows, Linux, macOS, cloud, SaaS, office suites, containers, ESXi, network devices, and identity providers.
Executive priority
Prioritize this technique as a resilience and audit concern: account and privilege changes are high-value control points for persistence and privilege escalation. Executives should ask whether privileged changes are approved, logged, reviewed, and reversible across on-prem, cloud, SaaS, email, MFA/device registration, and container platforms. This also supports compliance evidence because account lifecycle management, least privilege, privileged account management, and MFA are directly relevant mitigations.
Technical view
ATT&CK does not provide official detection text for T1098, but relationship context includes DET0096, Account Manipulation Behavior Chain Detection. SOC and IR teams should validate detections around account modification chains rather than isolated events only: credential changes, permission or role additions, mailbox delegation, cloud credential creation, device registration, SSH authorized_keys modification, local/domain group additions, and container RBAC binding changes. Windows audit references include user account changes and object permission changes, such as Event ID 4738 and 4670, but coverage must extend beyond Windows because the technique spans identity providers, IaaS, SaaS, Office Suite, containers, ESXi, Linux, macOS, network devices, and Windows.
Likely telemetry
- Identity provider audit logs for user, role, credential, MFA, and device registration changes
- Cloud IAM and SaaS administrative audit logs for credential, role, policy, and permission updates
- Office suite and email audit logs for mailbox delegation and administrator role changes
- Windows security logs for account and permission changes, including events referenced by ATT&CK external sources such as 4738 and 4670
- Linux, macOS, and ESXi authentication and account management logs
Detection direction
- Build detections around high-risk account change sequences: new credential plus role addition, group membership change followed by privileged access, MFA/device registration after credential compromise indicators, or mailbox delegation without expected administration context.
- Baseline legitimate administrative workflows so alerts can distinguish scheduled identity operations from unusual timing, actor, source location, affected account criticality, or cross-platform privilege expansion.
- Tune for privileged and sensitive accounts first, including administrators, service accounts, cloud principals, mailbox administrators, container service accounts, and accounts with access to critical systems.
- Correlate endpoint, IdP, cloud, SaaS, and PAM logs; a common blind spot is detecting Windows account changes while missing equivalent cloud role, SaaS delegate, MFA device, SSH key, or container RBAC modifications.
- Use relationship-driven context from sub-techniques T1098.001 through T1098.007 to create platform-specific analytics rather than relying on a single generic rule.
Mitigation priorities
- Start with User Account Management: enforce account lifecycle controls for creation, modification, deactivation, and periodic access review.
- Apply Privileged Account Management and least privilege to reduce who can modify credentials, groups, roles, mailbox permissions, MFA devices, SSH keys, and container RBAC.
- Require MFA for critical systems and identity providers, while also monitoring MFA/device enrollment and changes because device registration is represented as a related sub-technique.
- Restrict file and directory permissions on account- and authentication-related files, including locations relevant to SSH key-based access where applicable.
- Harden operating system and platform configurations, disabling or removing unnecessary features, services, or legacy capabilities that expand account-management attack surface.
Analyst notes and limits
T1098 is a broad parent technique for persistence and privilege escalation. The supplied relationships show multiple sub-techniques across cloud credentials, email delegation, cloud roles, SSH keys, device registration, container roles, and local/domain groups. ATT&CK also links this technique to several groups, software entries, and a campaign, including a cyber-physical context in the 2016 Ukraine Electric Power Attack relationship; these are useful for prioritization and threat modeling but should not be treated as proof of current exploitation in any environment.
Official detection guidance is not provided for this ATT&CK object. The guidance above is derived from the official description, platforms, tactics, external references, and supplied relationships. Local validation is required to confirm which platforms are in scope, which logs are retained, what administrative changes are authorized, and whether detections cover the relevant sub-techniques.
Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1098.001 | Additional Cloud Credentials Sub-technique | Additional Cloud Credentials subtechnique of this object. |
| Enterprise | T1098.002 | Additional Email Delegate Permissions Sub-technique | Additional Email Delegate Permissions subtechnique of this object. |
| Enterprise | T1098.003 | Additional Cloud Roles Sub-technique | Additional Cloud Roles subtechnique of this object. |
| Enterprise | T1098.005 | Device Registration Sub-technique | Device Registration subtechnique of this object. |
| Enterprise | T1098.006 | Additional Container Cluster Roles Sub-technique | Additional Container Cluster Roles subtechnique of this object. |
| Enterprise | T1098.004 | SSH Authorized Keys Sub-technique | SSH Authorized Keys subtechnique of this object. |
| Enterprise | T1098.007 | Additional Local or Domain Groups Sub-technique | Additional Local or Domain Groups subtechnique of this object. |
Groups, software, and campaigns
G0032: Lazarus Group
Lazarus Group is a North Korean state-sponsored cyber threat group attributed to the Reconnaissance General Bureau (RGB). [1] [2] Lazarus Group has been active since at least 2009 and is reportedly responsible for the November 2014 destructive wiper attack on Sony Pictures Entertainment, identified by Novetta as part of Operation Blockbuster. Malware used by Lazarus Group correlates to other reported campaigns, including Operation Flame, Operation 1Mission, Operation Troy, DarkSeoul, and Ten Days of Rain.[3]
North Korea’s cyber operations have shown a consistent pattern of adaptation, forming and reorganizing units as national priorities shift. These units frequently share personnel, infrastructure, malware, and tradecraft, making it difficult to attribute specific operations with high confidence. Public reporting often uses “Lazarus Group” as an umbrella term for multiple North Korean cyber operators conducting espionage, destructive attacks, and financially motivated campaigns.[4][5][6]
G1015: Scattered Spider
Scattered Spider is a native English-speaking cybercriminal group active since at least 2022. [1] [2] The group initially targeted customer relationship management (CRM) providers, business process outsourcing (BPO) firms, and telecommunications and technology companies before expanding in 2023 to gaming, hospitality, retail, managed service provider (MSP), manufacturing, and financial sectors. [2] Scattered Spider relies heavily on social engineering, including impersonating IT and help-desk staff, to gain initial access, bypass multi-factor authentication (MFA), and compromise enterprise networks. The group has adapted its tooling to evade endpoint detection and response (EDR) defenses and used ransomware for financial gain. [3] [4] [5] Scattered Spider had expanded into hybrid cloud and identity environments, using help-desk impersonation and MFA bypass to obtain administrator access in Okta, AWS, and Office 365. [6]
G1055: VOID MANTICORE
VOID MANTICORE is a threat group assessed to operate on behalf of Iran’s Ministry of Intelligence and Security (MOIS).[1] Active since at least mid-2022, VOID MANTICORE has targeted government entities, critical infrastructure, and private sector organizations across Albania, Israel, and the United States.[1][2] VOID MANTICORE conducts destructive cyber operations, combining wiper attacks with hack-and-leak campaigns. The group has operated under multiple public-facing personas, including HomeLand Justice in operations against Albania, Karma and Karma Below in campaigns targeting Israeli organizations, and Handala Hack, its current primary persona, which has claimed activity against Israeli and U.S. entities, including a March 2026 attack against Stryker Corporation.[1][3] VOID MANTICORE has been observed collaborating with Scarred Manticore, which has been linked to initial access operations preceding VOID MANTICORE’s activity.[4]
G0125: HAFNIUM
HAFNIUM is a likely state-sponsored cyber espionage group operating out of China that has been active since at least January 2021. HAFNIUM primarily targets entities in the US across a number of industry sectors, including infectious disease researchers, law firms, higher education institutions, defense contractors, policy think tanks, and NGOs. HAFNIUM has targeted remote management tools and cloud software for intial access and has demonstrated an ability to quickly operationalize exploits for identified vulnerabilities in edge devices.[1][2][3]
S0002: Mimikatz
S9008: Shai-Hulud
Shai-Hulud is a supply chain worm, first reported in September 2025, that spreads through code repositories, including GitHub and NPM packages. It exploits CI/CD pipeline dependencies to propagate to victims and poisons the supply chain by publishing malicious packages. Once inside a victim environment, Shai-Hulud steals credentials and access tokens from compromised repository accounts and exfiltrates them to attacker-controlled servers via encoded GitHub Actions workflows.[1][2][3][4][5][6][7]
S0274: Calisto
C0025: 2016 Ukraine Electric Power Attack
2016 Ukraine Electric Power Attack was a Sandworm Team campaign during which they used Industroyer malware to target and disrupt distribution substations within the Ukrainian power grid. This campaign was the second major public attack conducted against Ukraine by Sandworm Team.[1][2]
All related ATT&CK context
Mitigation direction
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 2.8 | Current bundle | f22b2fa1a4aa… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
FireEye SMOKEDHAM June 2021
FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.
Open source URL -
[2]
GitHub Mimikatz Issue 92 June 2017
Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.
Open source URL -
[3]
InsiderThreat ChangeNTLM July 2017
Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.
Open source URL -
[4]
Microsoft Security Event 4670
Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.
Open source URL -
[5]
Microsoft User Modified Event
Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.
Open source URL -
[6]
mitre-attack T1098Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.