detection.wiki

ATT&CK coverage › Technique

Account Manipulation T1098

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Events covered

27 catalog events are tagged with this technique by at least one rule.

ProviderEvent IDTitle
Sysmon1Process creation
Sysmon13RegistryEvent (Value Set)
Security-Auditing4624An account was successfully logged on.
Security-Auditing4625An account failed to log on.
Security-Auditing4634An account was logged off.
Security-Auditing4663An attempt was made to access an object.
Security-Auditing4688A new process has been created.
Security-Auditing4704A user right was assigned.
Security-Auditing4706A new trust was created to a domain.
Security-Auditing4720A user account was created.
Security-Auditing4722A user account was enabled.
Security-Auditing4724An attempt was made to reset an account's password.
Security-Auditing4725A user account was disabled.
Security-Auditing4726A user account was deleted.
Security-Auditing4728A member was added to a security-enabled global group.
Security-Auditing4729A member was removed from a security-enabled global group.
Security-Auditing4730A security-enabled global group was deleted.
Security-Auditing4732A member was added to a security-enabled local group.
Security-Auditing4738A user account was changed.
Security-Auditing4742A computer account was changed.
Security-Auditing4756A member was added to a security-enabled universal group.
Security-Auditing4781The name of an account was changed.
Security-Auditing4794An attempt was made to set the Directory Services Restore Mode administrator password.
Security-Auditing5136A directory service object was modified.
Security-Auditing5137A directory service object was created.
Defender-DeviceEvents9007007User account added to local group
PowerShell4104Creating Scriptblock text (MessageNumber of MessageTotal).

Authoring guide

Patterns shared across the 55 rules above: which fields they filter on, what specific values they look for, and what they exclude. Field names are normalized across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (40 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
EventID12eq 10, in 25136, 4728, 4725, 4726, 13
AttributeLDAPDisplayName11eq 11servicePrincipalName, userAccountControl, dSHeuristics, msDS-ManagedAccountPrecededByLink, msPKIAccountCredentials
AttributeValue5match 3, in 1, starts_with 166080, 66048, [0-9]{15}([1-9a-f]).*, 1131f6aa-9c07-11d1-f79f-00c04fc2dcd2;;S-1-5-21-, 89e95b76-444d-4c62-991a-0facbeda640c;;S-1-5-21-
ObjectClass5eq 5user, msDS-DelegatedManagedServiceAccount, dnsNode, dnsZone, dnsZoneScope
OperationType4eq 4%%14674, "%%14674"
EventType4eq 4reset-password, logged-in, renamed-user-account, changed-computer-account, added-member-to-group
user4eq 2, match 1, ends_with 1, starts_with 1SVC, DMZ, service, $, Administr
CommandLine4match 4Add-LocalGroupMember , /add, New-ADServiceAccount, -path, -CreateDelegatedServiceAccount
ScriptBlockText3match 3CN=, .Put("msDS-ManagedAccountPrecededByLink, New-ADServiceAccount, -path, -CreateDelegatedServiceAccount
unique_users3gt 35
status3eq 3success
user.id2ne 1, starts_with 1S-1-5-18, S-1-12-1-, S-1-5-21-
NewUACList2eq 2USER_DONT_EXPIRE_PASSWORD, USER_DONT_REQUIRE_PREAUTH
TargetSid2wildcard 1, eq 1S-1-5-21-*-500, S-1-12-1-*-500, S-1-5-32-544
SubjectUserSid2eq 1, regex_match 1S-1-5-18, S-\d-\d+-\d+-(\d+-){1,5}\d+

Top indicator values (160 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique.

FieldKindValueRules (here)Corpus reach
AttributeLDAPDisplayNameeqservicePrincipalName46
OperationTypeeq%%1467434
ObjectClassequser34
EventIDeq5136322
unique_usersgt533
statuseqsuccess33
CommandLinematchlocalgroup 23
CommandLinematch /add25
CommandLinematchAdd-LocalGroupMember 23
CommandLinematch -Group 23
EventIDeq47282
isOutliereq1216
user.idneS-1-5-181
NewUACListeqUSER_DONT_EXPIRE_PASSWORD1
AttributeValuein660481
AttributeLDAPDisplayNameequserAccountControl1
AttributeValuein660801
TargetSidwildcardS-1-5-21-*-5001
EventTypeeqlogged-in17
LogonTypeeqNetwork14

Common exclusions (12 distinct)

Field/operator/value combinations that rules under this technique routinely exclude (top-level not() clauses). These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths.

FieldKindValueRules excluding
userwildcardPIM_*1
userwildcard*$1
userwildcardsvc*1
userwildcard_*_1
userwildcard*-*-*1
group.idwildcardS-1-5-21-*-5131
SubjectUserSideqS-1-5-181
NewTargetUserNameends_with$1
userstarts_withMSOL_1
SubjectUserSideqmachineAccountSIDs1
ComputercontainsActor1
new_aceeqold_values1

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Sigma 16 rules

Elastic 17 rules

Splunk 13 rules

Kusto Query Language 9 rules