T1098.007: Additional Local or Domain Groups
An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.[1][2] On Linux, adversaries may use the `usermod` command for the same purpose.[3]
For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage Remote Desktop Protocol to log into the endpoints in the future.[4] Adversaries may also add accounts to VPN user groups to gain future persistence on the network.[5] On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage Sudo and Sudo Caching for elevated privileges.
In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.[6]
Analyst context for executives and security teams
This technique matters because a single unauthorized group membership change can convert a compromised account into durable administrative, remote access, VPN, or sudo-capable access. For leaders, the risk is not just account misuse; it is persistence that can survive password resets, enable later re-entry, and complicate incident containment across Windows, Linux, macOS, and domain environments.
Executive priority
Prioritize evidence that privileged and remote-access group membership is governed, monitored, and reviewed. The business decision is whether the organization can quickly prove who added an account to local administrators, domain groups, Remote Desktop Users, VPN groups, or sudo-capable groups, and whether that change was approved. This supports incident response readiness, audit evidence, access governance, and resilience against privilege escalation and re-entry after containment.
Technical view
SOC and IR teams should validate coverage for suspicious additions to local or domain groups, aligned to the related ATT&CK detection strategy DET0310. On Windows, monitor use of net localgroup and net group as well as directory or local security authority changes that add users or machine accounts to groups. On Linux, monitor usermod activity and changes that place accounts into sudo-capable groups. Pay special attention to additions involving local administrators, domain privileged groups, Remote Desktop Users, VPN access groups, sudoers-related groups, and machine accounts added to domain groups. Do not rely only on command-line detection; group membership can be changed through administrative tools, scripts, APIs, or management systems.
Likely telemetry
- Endpoint process execution and command-line telemetry for net localgroup, net group, usermod, and administrative scripts
- Windows local group and domain group membership change events
- Active Directory or directory service audit logs showing user or machine account group membership modifications
- Linux authentication, audit, and account management logs related to user and group modification
- File or configuration monitoring for local account and group databases where applicable
Detection direction
- Alert on additions to high-risk groups such as local administrators, domain privileged groups, Remote Desktop Users, VPN access groups, and sudo-capable groups.
- Include machine accounts added to domain groups as a specific review case because the ATT&CK description notes this can grant domain privileges to the local SYSTEM account.
- Correlate group additions with recent account creation, unusual administrator activity, remote logon activity, or incident containment timelines.
- Baseline legitimate helpdesk, provisioning, endpoint management, and identity administration workflows to reduce false positives without suppressing high-risk groups.
- Validate that detections cover both command-line utilities and non-command-line modification paths.
Mitigation priorities
- Restrict who can modify local, domain, remote access, VPN, and sudo-capable groups.
- Require approval and change records for privileged and remote-access group membership changes.
- Review privileged group membership regularly, including local administrators, domain groups, RDP-related groups, VPN groups, sudo-capable groups, and machine accounts in domain groups.
- Harden incident response playbooks so containment includes group membership review, not only password resets or account disabling.
- Separate routine administration from privileged access paths where possible and remove standing membership that is not required.
Analyst notes and limits
ATT&CK places this as a sub-technique of Account Manipulation under persistence and privilege escalation. The relationship set includes detection strategy DET0310 and multiple groups and software that use the technique, including Net on Windows. That relationship context supports treating group membership changes as a high-value detection and response use case, but it does not by itself prove activity in any specific environment.
The official ATT&CK object does not provide detection text or mitigation entries, and the supplied description gives command examples mainly for Windows and Linux. macOS is listed as a platform, but no macOS-specific commands are supplied. Local logging, directory architecture, VPN integration, and administrative workflows must be validated in the customer environment before judging coverage.
Additional Local or Domain Groups
An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups.[1][2] On Linux, adversaries may use the `usermod` command for the same purpose.[3]
For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage Remote Desktop Protocol to log into the endpoints in the future.[4] Adversaries may also add accounts to VPN user groups to gain future persistence on the network.[5] On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage Sudo and Sudo Caching for elevated privileges.
In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.[6]
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
Related techniques
This mirrors the MITRE pattern of making group, software, campaign, and technique relationships scannable. Relationship notes come from mirrored ATT&CK relationship text when available.
| Domain | ID | Name | Relationship / procedure |
|---|---|---|---|
| Enterprise | T1098 | Account Manipulation | This object subtechnique of Account Manipulation. |
Groups, software, and campaigns
G0096: APT41
APT41 is a threat group that researchers have assessed as Chinese state-sponsored espionage group that also conducts financially-motivated operations. Active since at least 2012, APT41 has been observed targeting various industries, including but not limited to healthcare, telecom, technology, finance, education, retail and video game industries in 14 countries.[1] Notable behaviors include using a wide range of malware and tools to complete mission objectives. APT41 overlaps at least partially with public reporting on groups including BARIUM and Winnti Group.[2][3]
G0022: APT3
APT3 is a China-based threat group that researchers have attributed to China's Ministry of State Security.[1][2] This group is responsible for the campaigns known as Operation Clandestine Fox, Operation Clandestine Wolf, and Operation Double Tap.[1][3] As of June 2015, the group appears to have shifted from targeting primarily US victims to primarily political organizations in Hong Kong.[4]
G0059: Magic Hound
Magic Hound is an Iranian-sponsored threat group that conducts long term, resource-intensive cyber espionage operations, likely on behalf of the Islamic Revolutionary Guard Corps. They have targeted European, U.S., and Middle Eastern government and military personnel, academics, journalists, and organizations such as the World Health Organization (WHO), via complex social engineering campaigns since at least 2014.[1][2][3][4][5]
G1023: APT5
APT5 is a China-based espionage actor that has been active since at least 2007 primarily targeting the telecommunications, aerospace, and defense industries throughout the U.S., Europe, and Asia. APT5 has displayed advanced tradecraft and significant interest in compromising networking devices and their underlying software including through the use of zero-day exploits.[1][2][3][4][5][6]
G0035: Dragonfly
Dragonfly is a cyber espionage group that has been attributed to Russia's Federal Security Service (FSB) Center 16.[1][2] Active since at least 2010, Dragonfly has targeted defense and aviation companies, government entities, companies related to industrial control systems, and critical infrastructure sectors worldwide through supply chain, spearphishing, and drive-by compromise attacks.[3][4][5][6][7][8][9]
G1016: FIN13
G0094: Kimsuky
Kimsuky is a Democratic People's Republic of Korea (DPRK)-based cyber espionage group that has been active since at least 2012. The group initially targeted South Korean government agencies, think tanks, and subject-matter experts in various fields. Its operations expanded to include the United Nations and organizations in the government, education, business services, and manufacturing sectors across the United States, Japan, Russia, and Europe. Kimsuky has focused collection on foreign policy and national security issues tied to the Korean Peninsula, nuclear policy, and sanctions. Kimsuky operations have overlapped with those of other North Korean state-sponsored cyber espionage actors as a result of ad hoc collaborations or other limited resource sharing.[1][2][3][4][5][6]
Kimsuky was assessed to be responsible for the 2014 Korea Hydro & Nuclear Power Co. compromise; other notable campaigns include Operation STOLEN PENCIL (2018), Operation Kabar Cobra (2019), and Operation Smoke Screen (2019).[7][8][9] In 2023, Kimsuky was observed using commercial large language models (LLMs) to assist with vulnerability research, scripting, social engineering and reconnaissance.[10]
DPRK threat actor cluster boundaries overlap in open source reporting, with some security researchers consolidating all attributed North Korean state-sponsored cyber activity under Lazarus Group, rather than tracking operationally distinct subgroups.
S0649: SMOKEDHAM
S0039: Net
The Net utility is a component of the Windows operating system. It is used in command-line operations for control of users, groups, services, and network connections. [1]
Net has a great deal of functionality, [2] much of which is useful for an adversary, such as gathering system and network information for Discovery, moving laterally through SMB/Windows Admin Shares using net use commands, and interacting with services. The net1.exe utility is executed for certain functionality when net.exe is run and can be used directly in commands such as net1 user.
S1111: DarkGate
DarkGate first emerged in 2018 and has evolved into an initial access and data gathering tool associated with various criminal cyber operations. Written in Delphi and named "DarkGate" by its author, DarkGate is associated with credential theft, cryptomining, cryptotheft, and pre-ransomware actions.[1] DarkGate use increased significantly starting in 2022 and is under active development by its author, who provides it as a Malware-as-a-Service offering.[2]
S0382: ServHelper
ServHelper is a backdoor first observed in late 2018. The backdoor is written in Delphi and is typically delivered as a DLL file.[1]
All related ATT&CK context
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.1 | Current bundle | 422a0212861f… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
Microsoft Net Localgroup
Microsoft. (2016, August 31). Net Localgroup. Retrieved August 5, 2024.
Open source URL -
[2]
Microsoft Net Group
Microsoft. (2016, August 31). Net group. Retrieved August 5, 2024.
Open source URL -
[3]
Linux Usermod
Man7. (n.d.). Usermod. Retrieved August 5, 2024.
Open source URL -
[4]
Microsoft RDP Logons
Microsoft. (2017, April 9). Allow log on through Remote Desktop Services. Retrieved August 5, 2024.
Open source URL -
[5]
Cyber Security News
Kaaviya. (n.d.). SuperBlack Actors Exploiting Two Fortinet Vulnerabilities to Deploy Ransomware. Retrieved September 22, 2025.
Open source URL -
[6]
RootDSE AD Detection 2022
Scarred Monk. (2022, May 6). Real-time detection scenarios in Active Directory environments. Retrieved August 5, 2024.
Open source URL -
[7]
mitre-attack T1098.007Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.