Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK®

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts. During the 2016 Ukraine Electric Power Attack, Sandworm Team used the sp_addlinkedsrvlogin command in MS-SQL to create a link between a created account and other servers in the network.[2] APT3 has been known to add creat

Account Manipulation, Technique T1098 - Enterprise | MITRE ATT&CK® ATT&CKcon 7.0 is coming October 27-28, 2026. Learn more about ATT&CKcon 7.0 . Home Techniques Enterprise Account Manipulation Account Manipulation Sub-techniques (7) ID Name T1098.001 Additional Cloud Credentials T1098.002 Additional Email Delegate Permissions T1098.003 Additional Cloud Roles T1098.004 SSH Authorized Keys T1098.005 Device Registration T1098.006 Additional Container Cluster Roles T1098.007 Additional Local or Domain Groups Adversaries may manipulate accounts to maintain and/or elevate access to victim system

related reading

• Valid Accounts, Technique T1078 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Persistence, Tactic TA0003 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Initial Access, Tactic TA0001 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Trusted Relationship, Technique T1199 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Anomalies detected by the Microsoft Sentinel machine learning engine | Microsoft Learnlearn.microsoft.com
• Remote Services, Technique T1021 - Enterprise | MITRE ATT&CK®attack.mitre.org
• Assessing Claude Mythos Preview’s cybersecurity capabilities \ Anthropicred.anthropic.com
• Understanding the basics of Cloud Security: Cloud Privilege Escalation | Nightfall AInightfall.ai
• AWS IAM Privilege Escalation – Methods and Mitigationrhinosecuritylabs.com
• Exposing and shutting down an inbox heist in actionredcanary.com
• D3FEND Matrix | MITRE D3FEND™d3fend.mitre.org
• Cloud coverage: Detecting an email payroll diversion attackredcanary.com