Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
View in MITRE ATT&CK®| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| CIS-6.8 | Define and Maintain Role-Based Access Control | mitigates | T1098 | Account Manipulation |
Comments
Role-based access control (RBAC) can help mitigate account manipulation by limiting which roles are allowed to create or modify accounts and ensuring that low-privileged users do not have permissions to modify accounts or account-related policies.
References
|
| CIS-6.5 | Require MFA for Administrative Access | mitigates | T1098 | Account Manipulation |
Comments
Using multi-factor authentication for privileged administrative access reduces the success of adversary attempts to maintain or elevate access using compromised credentials.
References
|
| CIS-16.8 | Separate Production and Non-Production Systems | mitigates | T1098 | Account Manipulation |
Comments
Separating production and non-production environments with enforced network and administrative boundaries can restrict non-production systems and management paths from reaching production identity infrastructure, reducing opportunities to modify production accounts or authentication settings.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| advanced_protection_program | Advanced Protection Program | technique_scores | T1098 | Account Manipulation |
Comments
Advanced Protection Program enables the use of a security key for multi-factor authentication. This provides significant protection against unauthorized users from accessing and manipulating accounts to retain access.
References
|
| cloud_asset_inventory | Cloud Asset Inventory | technique_scores | T1098 | Account Manipulation |
Comments
This control may be able to detect when adversaries use cloud accounts to elevate privileges through manipulation of IAM or access policies. This monitoring can be fine tuned to specific assets, policies, and organizations.
References
|
| google_secops | Google Security Operations | technique_scores | T1098 | Account Manipulation |
Comments
Google Security Ops is able to trigger an alert to ensure multi-factor authentication is enabled for all non-service and administrator accounts.
This technique was scored as minimal based on low or uncertain detection coverage factor.
https://github.com/chronicle/detection-rules/blob/main/gcp_cloudaudit/gcp_multifactor_authentication.yaral
References
|
| identity_and_access_management | Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
Privileged roles and permissions can be granted to entire groups of users by default, and admins can control unwanted access by utilizing machine learning to recommend smart access control permissions within an organization. This control can help mitigate adversaries from gaining access to unwanted account.
References
|
| identity_platform | Identity Platform | technique_scores | T1098 | Account Manipulation |
Comments
Identity Platform can help protect your app's users and prevent account takeovers by offering multi-factor authentication (MFA) and integrating with Google's intelligence for account protection. This will help mitigate adversaries from gaining access to permission levels.
References
|
| policy_intelligence | Policy Intelligence | technique_scores | T1098 | Account Manipulation |
Comments
Utilization and enforcement of MFA for user accounts to ensure that IAM policies are implemented properly shall mitigate adversaries so that they may not gain access to user accounts. Enforce the principle of least privilege by ensuring that principals have only the permissions that they actually need.
References
|
| resource_manager | Resource Manager | technique_scores | T1098 | Account Manipulation |
Comments
GCP offers Identity and Access Management (IAM), which lets admins give more granular access to specific Google Cloud resources and prevents unwanted access to other resources. This allows configuration of access controls and firewalls to limit access to critical systems and domain controllers.
References
|
| vpc_service_controls | VPC Service Controls | technique_scores | T1098 | Account Manipulation |
Comments
VPC further segments the environment by providing configurable granular access controls which help limit user communications to critical systems.
References
|
| Capability ID | Capability Description | Mapping Type | ATT&CK ID | ATT&CK Name | Notes |
|---|---|---|---|---|---|
| aws_security_hub | AWS Security Hub | technique_scores | T1098 | Account Manipulation |
Comments
AWS Security Hub performs a check from the AWS Foundations CIS Benchmark that, if implemented, would help towards detecting the manipulation of accounts. AWS Security Hub provides this detection with the following check.
3.4 Ensure a log metric filter and alarm exist for IAM policy changes
This is scored as Minimal because it only supports a subset of the sub-techniques.
References
|
| aws_config | AWS Config | technique_scores | T1098 | Account Manipulation |
Comments
This control provides significant coverage for one of this technique's sub-techniques, resulting in an overall score of Minimal.
References
|
| aws_identity_and_access_management | AWS Identity and Access Management | technique_scores | T1098 | Account Manipulation |
Comments
This control may generate logs for creation and manipulation of accounts but the relevant security information would be handled by another security control.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | technique_scores | T1098 | Account Manipulation |
Comments
IAM Access Analyzer can protect against adversaries manipulating accounts to maintain and/or elevate access to victim systems through its external access analysis and access policy generation. It is scored as Partial because findings are not generated in real time and must be reviewed and applied by administrators.
References
|
| aws_iam_access_analyzer | AWS IAM Access Analyzer | technique_scores | T1098 | Account Manipulation |
Comments
IAM Access Analyzer can detect adversaries manipulating accounts to maintain and/or elevate access to victim systems through its external access analysis. It is scored as Partial because findings are not generated in real time and must be acted upon by administrators.
References
|
| amazon_guardduty | Amazon GuardDuty | technique_scores | T1098 | Account Manipulation |
Comments
GuardDuty has a finding types that flag events where an adversary may have compromised an AWS IAM User. Finding Type: Persistence:IAMUser/AnomalousBehavior
References
|
| Technique ID | Technique Name | Number of Mappings |
|---|---|---|
| T1098.003 | Additional Cloud Roles | 6 |
| T1098.006 | Additional Container Cluster Roles | 4 |
| T1098.007 | Additional Local or Domain Groups | 2 |
| T1098.004 | SSH Authorized Keys | 5 |
| T1098.005 | Device Registration | 5 |
| T1098.001 | Additional Cloud Credentials | 18 |
| T1098.002 | Additional Email Delegate Permissions | 3 |