{"source_checked_on":"2026-10-19","schema_version":1,"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","domain":"enterprise","reviewed_on":"2026-09-28","source_url":"https://attack.mitre.org/techniques/T1098","source_file":{"file":"enterprise.json","url":"https://raw.githubusercontent.com/mitre-attack/attack-stix-data/20664a889568dce884a1dac0ec7b12ae3a199f51/enterprise-attack/enterprise-attack-20.0.json","sha256":"81113ba98afa2928f3dcff62022539f7ce30c315c32e14422f11ff95ce534352","bytes":55271014},"source_object_sha256":"b56a4dfe5d98b3fe6ec9c608d585ea096561b2341a467a7e3daf84e86687e6a9","description":"Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. \n\nIn order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).","references":[{"source_name":"mitre-attack","url":"https://attack.mitre.org/techniques/T1098","external_id":"T1098"},{"source_name":"FireEye SMOKEDHAM June 2021","description":"FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.","url":"https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"},{"source_name":"Microsoft Security Event 4670","description":"Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.","url":"https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670"},{"source_name":"Microsoft User Modified Event","description":"Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.","url":"https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738"},{"source_name":"InsiderThreat ChangeNTLM July 2017","description":"Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.","url":"https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM"},{"source_name":"GitHub Mimikatz Issue 92 June 2017","description":"Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.","url":"https://github.com/gentilkiwi/mimikatz/issues/92"}],"platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"visibility":"source_mapped","visibility_note":null,"parent":null,"children":[{"key":"enterprise/T1098.001","id":"T1098.001","name":"Additional Cloud Credentials","page":"techniques/enterprise/T1098.001/"},{"key":"enterprise/T1098.002","id":"T1098.002","name":"Additional Email Delegate Permissions","page":"techniques/enterprise/T1098.002/"},{"key":"enterprise/T1098.003","id":"T1098.003","name":"Additional Cloud Roles","page":"techniques/enterprise/T1098.003/"},{"key":"enterprise/T1098.004","id":"T1098.004","name":"SSH Authorized Keys","page":"techniques/enterprise/T1098.004/"},{"key":"enterprise/T1098.005","id":"T1098.005","name":"Device Registration","page":"techniques/enterprise/T1098.005/"},{"key":"enterprise/T1098.006","id":"T1098.006","name":"Additional Container Cluster Roles","page":"techniques/enterprise/T1098.006/"},{"key":"enterprise/T1098.007","id":"T1098.007","name":"Additional Local or Domain Groups","page":"techniques/enterprise/T1098.007/"}],"telemetry":[{"id":"DC0066","name":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an Active Directory object attribute.","collection_focus":"Enable Audit Directory Service Changes with appropriate object SACLs on lab DCs; retain 5136 attribute/value and correlation context.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["object_dn","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."},{"id":"DC0061","name":"File Modification","page":"telemetry/DC0061/","kind":"attack_component","category":"Endpoint activity","description":"Changes to file data or attributes.","collection_focus":"Use file-integrity monitoring or scoped OS file-write auditing for general changes. Sysmon 2 records creation-time changes; it is not a general file-write event.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":null,"required_fields":["path","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0032","name":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component","category":"Endpoint activity","description":"Creation of a process with executable, command line, parent and security context.","collection_focus":"Collect Sysmon ProcessCreate (1); preserve ProcessGuid and parent identifiers. Security 4688 is an alternative with separate audit/command-line settings.","providers":[{"name":"Microsoft Sysmon","scope":"Windows event-based collection; enable the event types needed below.","source_id":"sysmon"},{"name":"Linux Audit","scope":"Linux alternative for supported system-call and file events; different semantics and fields.","source_id":"linux"},{"name":"Apple Endpoint Security clients","scope":"macOS alternative where the subscribed event exists; requires an entitled, approved client, not an iOS collector.","source_id":"apple"}],"configuration":["On a disposable Windows host, review the installed Sysmon schema and current configuration; merge scoped event filters into the existing policy rather than replacing it.","Forward Microsoft-Windows-Sysmon/Operational to the lab collector. Preserve event ID, timestamp, computer, process identifiers and the original event.","For Linux or macOS, select the equivalent sensor separately and test its emitted fields; a Windows event ID does not transfer across platforms."],"configuration_example":{"label":"Sysmon filter fragment · merge into the reviewed lab configuration","language":"xml","source_id":"sysmon_config","content":"<EventFiltering>\n  <ProcessCreate onmatch=\"include\">\n    <Image condition=\"is\">C:\\Windows\\System32\\whoami.exe</Image>\n  </ProcessCreate>\n</EventFiltering>","note":"This fragment only selects the named process. It is not a complete production policy. Inspect the installed schema with sysmon64 -s; preserve existing rules, then apply the reviewed complete configuration with sysmon64 -c <configuration-file>."},"required_fields":["process_guid","image","parent_image","command_line","user"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"Event filtering and sensor versions change coverage. High-volume image-load and process-access collection needs tuning; endpoint events alone do not establish intent.","sources":[{"id":"sysmon","title":"Microsoft Sysmon events and configuration","url":"https://learn.microsoft.com/en-us/sysinternals/downloads/sysmon"},{"id":"sysmon_config","title":"Microsoft Sysmon configuration files","url":"https://learn.microsoft.com/en-us/windows/security/operating-system-security/sysmon/sysmon-configuration-files"},{"id":"linux","title":"Linux Audit rule configuration","url":"https://www.man7.org/linux/man-pages/man8/auditctl.8.html"},{"id":"apple","title":"Apple Endpoint Security framework for macOS","url":"https://developer.apple.com/documentation/endpointsecurity"},{"id":"process_audit","title":"Microsoft process creation event 4688","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4688"}],"association":"attack_component","anomaly_design":"Per host role and user: rare process/object combinations, bursts of object access or modification, and ordered parent/action sequences. Compare maintenance windows and signed software rollout activity."},{"id":"DC0010","name":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component","category":"Windows and directory audit","description":"Modification of an account attribute, policy or enabled state.","collection_focus":"Enable Audit User Account Management and retain the changed attributes and target account; correlate approved administrative requests.","providers":[{"name":"Windows Security auditing","scope":"Policy-dependent account, object, task and logon records on the host that performs the operation.","source_id":"audit"},{"name":"Active Directory domain controllers","scope":"Directory changes and authentication records; collect from the relevant controllers, not only endpoints.","source_id":"ad"}],"configuration":["Use a lab-only GPO under Computer Configuration → Windows Settings → Security Settings → Advanced Audit Policy Configuration. Enable the specific subcategory named below.","For object-level auditing, configure a narrow system access control list (SACL) on the test object in addition to policy. Do not audit an entire production directory by default.","Forward Security events from the responsible host or controller; retain subject and target identities, object identifiers, result and original XML. Confirm effective policy with auditpol /get /category:*."],"configuration_example":null,"required_fields":["target_account","attribute","before","after"],"example":{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}},"example_note":"Project-normalized synthetic JSON, not a native provider log, captured event, attack verdict or validated detection. A parser/adapter is required for a real SIEM. Example names, IPs and values are fictional.","limitations":"A policy checkbox alone does not guarantee an event. Host role, SACL, success/failure selection and audit policy precedence matter. Directory changes may arrive as multiple records.","sources":[{"id":"audit","title":"Microsoft advanced security audit policy","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/advanced-security-audit-policy-settings"},{"id":"ad","title":"Microsoft Audit Directory Service Changes","url":"https://learn.microsoft.com/windows/security/threat-protection/auditing/audit-directory-service-changes"},{"id":"task","title":"Microsoft scheduled-task creation event 4698","url":"https://learn.microsoft.com/en-us/previous-versions/windows/it-pro/windows-10/security/threat-protection/auditing/event-4698"}],"association":"attack_component","anomaly_design":"Per principal, host and object: unusual access/request rates, new principal-object relationships, and changes outside approved administration windows. Control for service accounts and scheduled directory maintenance."}],"detection":{"key":"enterprise/T1098","id":"T1098","name":"Account Manipulation","domain":"enterprise","platforms":["Containers","ESXi","IaaS","Identity Provider","Linux","macOS","Network Devices","Office Suite","SaaS","Windows"],"environments":["cloud","cloud-hosted-endpoint","containers","identity","network-infrastructure","onprem","saas","virtualization"],"source_url":"https://attack.mitre.org/techniques/T1098","technique_page":"techniques/enterprise/T1098/","page":"detections/enterprise/T1098/","status":"rule_source_available","counts":{"sigma":31,"atlas_basic":1,"atlas_anomaly":1,"strategies":1,"analytics":6,"live_validated":0},"sigma_rules":[{"id":"aac6c4f4-87c7-4961-96ac-c3fd3a42c310","title":"Bitbucket Global Permission Changed","status":"test","level":"medium","logsource":{"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."},"data_path":"data/detection-rules/aac6c4f4-87c7-4961-96ac-c3fd3a42c310.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/application/bitbucket/audit/bitbucket_audit_global_permissions_change_detected.yml","author":"Muhammad Faisal (@faisalusuf)","kind":"sigma"},{"id":"0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2","title":"AWS IAM Backdoor Users Keys","status":"test","level":"medium","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_iam_backdoor_users_keys.yml","author":"faloker","kind":"sigma"},{"id":"3940b5f1-3f46-44aa-b746-ebe615b879e0","title":"AWS Route 53 Domain Transfer Lock Disabled","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/3940b5f1-3f46-44aa-b746-ebe615b879e0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_lock_disabled.yml","author":"Elastic, Austin Songer @austinsonger","kind":"sigma"},{"id":"b056de1a-6e6e-4e40-a67e-97c9808cf41b","title":"AWS Route 53 Domain Transferred to Another Account","status":"test","level":"low","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/b056de1a-6e6e-4e40-a67e-97c9808cf41b.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_route_53_domain_transferred_to_another_account.yml","author":"Elastic, Austin Songer @austinsonger","kind":"sigma"},{"id":"055fb148-60f8-462d-ad16-26926ce050f1","title":"AWS User Login Profile Was Modified","status":"test","level":"high","logsource":{"product":"aws","service":"cloudtrail"},"data_path":"data/detection-rules/055fb148-60f8-462d-ad16-26926ce050f1.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/aws/cloudtrail/aws_update_login_profile.yml","author":"toffeebr33k","kind":"sigma"},{"id":"d2d901db-7a75-45a1-bc39-0cbf00812192","title":"Number Of Resource Creation Or Deployment Activities","status":"test","level":"medium","logsource":{"product":"azure","service":"activitylogs"},"data_path":"data/detection-rules/d2d901db-7a75-45a1-bc39-0cbf00812192.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/activity_logs/azure_creating_number_of_resources_detection.yml","author":"sawwinnnaung","kind":"sigma"},{"id":"4d78a000-ab52-4564-88a5-7ab5242b20c7","title":"Change to Authentication Method","status":"test","level":"medium","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/4d78a000-ab52-4564-88a5-7ab5242b20c7.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_change_to_authentication_method.yml","author":"AlertIQ","kind":"sigma"},{"id":"102e11e3-2db5-4c9e-bc26-357d42585d21","title":"Bulk Deletion Changes To Privileged Account Permissions","status":"test","level":"high","logsource":{"product":"azure","service":"auditlogs"},"data_path":"data/detection-rules/102e11e3-2db5-4c9e-bc26-357d42585d21.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/audit_logs/azure_priviledged_role_assignment_bulk_change.yml","author":"Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'","kind":"sigma"},{"id":"258b6593-215d-4a26-a141-c8e31c1299a6","title":"Anomalous User Activity","status":"test","level":"high","logsource":{"product":"azure","service":"riskdetection"},"data_path":"data/detection-rules/258b6593-215d-4a26-a141-c8e31c1299a6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/azure/identity_protection/azure_identity_protection_anomalous_user.yml","author":"Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'","kind":"sigma"},{"id":"32438676-1dba-4ac7-bf69-b86cba995e05","title":"GCP Access Policy Deleted","status":"test","level":"medium","logsource":{"product":"gcp","service":"gcp.audit"},"data_path":"data/detection-rules/32438676-1dba-4ac7-bf69-b86cba995e05.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/audit/gcp_access_policy_deleted.yml","author":"Bryan Lim","kind":"sigma"},{"id":"04e2a23a-9b29-4a5c-be3a-3542e3f982ba","title":"Google Workspace Granted Domain API Access","status":"test","level":"medium","logsource":{"product":"gcp","service":"google_workspace.admin"},"data_path":"data/detection-rules/04e2a23a-9b29-4a5c-be3a-3542e3f982ba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_granted_domain_api_access.yml","author":"Austin Songer","kind":"sigma"},{"id":"2d1b83e4-17c6-4896-a37b-29140b40a788","title":"Google Workspace User Granted Admin Privileges","status":"test","level":"medium","logsource":{"product":"gcp","service":"google_workspace.admin"},"data_path":"data/detection-rules/2d1b83e4-17c6-4896-a37b-29140b40a788.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/cloud/gcp/gworkspace/admin/gcp_gworkspace_user_granted_admin_privileges.yml","author":"Austin Songer","kind":"sigma"},{"id":"0ac15ec3-d24f-4246-aa2a-3077bb1cf90e","title":"Privileged User Has Been Created","status":"test","level":"high","logsource":{"product":"linux","definition":"/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work"},"data_path":"data/detection-rules/0ac15ec3-d24f-4246-aa2a-3077bb1cf90e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/builtin/lnx_privileged_user_creation.yml","author":"Pawel Mazur","kind":"sigma"},{"id":"9691f58d-92c1-4416-8bf3-2edd753ec9cf","title":"ESXi Admin Permission Assigned To Account Via ESXCLI","status":"test","level":"high","logsource":{"category":"process_creation","product":"linux"},"data_path":"data/detection-rules/9691f58d-92c1-4416-8bf3-2edd753ec9cf.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_esxcli_permission_change_admin.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"6d844f0f-1c18-41af-8f19-33e7654edfc3","title":"Cisco Local Accounts","status":"test","level":"high","logsource":{"product":"cisco","service":"aaa"},"data_path":"data/detection-rules/6d844f0f-1c18-41af-8f19-33e7654edfc3.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/network/cisco/aaa/cisco_cli_local_accounts.yml","author":"Austin Clark","kind":"sigma"},{"id":"c43c26be-2e87-46c7-8661-284588c5a53e","title":"A Member Was Added to a Security-Enabled Global Group","status":"stable","level":"low","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/c43c26be-2e87-46c7-8661-284588c5a53e.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_member_added_security_enabled_global_group.yml","author":"Alexandr Yampolskyi, SOC Prime","kind":"sigma"},{"id":"02c39d30-02b5-45d2-b435-8aebfe5a8629","title":"A Member Was Removed From a Security-Enabled Global Group","status":"stable","level":"low","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/02c39d30-02b5-45d2-b435-8aebfe5a8629.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_member_removed_security_enabled_global_group.yml","author":"Alexandr Yampolskyi, SOC Prime","kind":"sigma"},{"id":"b237c54b-0f15-4612-a819-44b735e0de27","title":"A Security-Enabled Global Group Was Deleted","status":"stable","level":"low","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/b237c54b-0f15-4612-a819-44b735e0de27.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/account_management/win_security_security_enabled_global_group_deleted.yml","author":"Alexandr Yampolskyi, SOC Prime","kind":"sigma"},{"id":"2c99737c-585d-4431-b61a-c911d86ff32f","title":"Powerview Add-DomainObjectAcl DCSync AD Extend Right","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"},"data_path":"data/detection-rules/2c99737c-585d-4431-b61a-c911d86ff32f.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_account_backdoor_dcsync_rights.yml","author":"Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat","kind":"sigma"},{"id":"311b6ce2-7890-4383-a8c2-663a9f6b43cd","title":"Enabled User Right in AD to Control User Objects","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change"},"data_path":"data/detection-rules/311b6ce2-7890-4383-a8c2-663a9f6b43cd.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_active_directory_user_control.yml","author":"@neu5ron","kind":"sigma"},{"id":"300bac00-e041-4ee2-9c36-e262656a6ecc","title":"Active Directory User Backdoors","status":"test","level":"high","logsource":{"product":"windows","service":"security","definition":"Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes"},"data_path":"data/detection-rules/300bac00-e041-4ee2-9c36-e262656a6ecc.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_alert_ad_user_backdoors.yml","author":"@neu5ron","kind":"sigma"},{"id":"0255a820-e564-4e40-af2b-6ac61160335c","title":"A New Trust Was Created To A Domain","status":"stable","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/0255a820-e564-4e40-af2b-6ac61160335c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_add_domain_trust.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"53ad8e36-f573-46bf-97e4-15ba5bf4bb51","title":"Password Change on Directory Service Restore Mode (DSRM) Account","status":"stable","level":"high","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/53ad8e36-f573-46bf-97e4-15ba5bf4bb51.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_susp_dsrm_password_change.yml","author":"Thomas Patzke","kind":"sigma"},{"id":"c265cf08-3f99-46c1-8d59-328247057d57","title":"User Added to Local Administrator Group","status":"stable","level":"medium","logsource":{"product":"windows","service":"security"},"data_path":"data/detection-rules/c265cf08-3f99-46c1-8d59-328247057d57.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/builtin/security/win_security_user_added_to_local_administrators.yml","author":"Florian Roth (Nextron Systems)","kind":"sigma"},{"id":"02122374-b74e-495c-b285-9e4da973f3d6","title":"DMSA Service Account Created in Specific OUs - PowerShell","status":"experimental","level":"medium","logsource":{"category":"ps_script","product":"windows"},"data_path":"data/detection-rules/02122374-b74e-495c-b285-9e4da973f3d6.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_create_new_dmsasvc_account.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"4fdc44df-bfe9-4fcc-b041-68f5a2d3031c","title":"Powershell LocalAccount Manipulation","status":"test","level":"medium","logsource":{"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"},"data_path":"data/detection-rules/4fdc44df-bfe9-4fcc-b041-68f5a2d3031c.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_localuser.yml","author":"frack113","kind":"sigma"},{"id":"9b111d8e-92e0-4153-88bc-daefc1333aba","title":"DMSA Link Attributes Modified","status":"experimental","level":"low","logsource":{"category":"ps_script","product":"windows"},"data_path":"data/detection-rules/9b111d8e-92e0-4153-88bc-daefc1333aba.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/powershell/powershell_script/posh_ps_modification_of_dmsa_link_attribute.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"0ea8db81-2ff6-4525-9448-33bbe7effc13","title":"New DMSA Service Account Created in Specific OUs","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/0ea8db81-2ff6-4525-9448-33bbe7effc13.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_create_new_dmsasvc_account.yml","author":"Swachchhanda Shrawan Poudel (Nextron Systems)","kind":"sigma"},{"id":"ad720b90-25ad-43ff-9b5e-5c841facc8e5","title":"User Added to Local Administrators Group","status":"test","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/ad720b90-25ad-43ff-9b5e-5c841facc8e5.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_add_user_local_admin_group.yml","author":"Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"10fb649c-3600-4d37-b1e6-56ea90bb7e09","title":"User Added To Highly Privileged Group","status":"test","level":"high","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/10fb649c-3600-4d37-b1e6-56ea90bb7e09.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_susp_add_user_privileged_group.yml","author":"Nasreddine Bencherchali (Nextron Systems)","kind":"sigma"},{"id":"7864a175-3654-4824-9f0d-f0da18ab27c0","title":"Password Set to Never Expire via WMI","status":"experimental","level":"medium","logsource":{"category":"process_creation","product":"windows"},"data_path":"data/detection-rules/7864a175-3654-4824-9f0d-f0da18ab27c0.json","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/process_creation/proc_creation_win_wmi_password_never_expire.yml","author":"Daniel Koifman (KoifSec)","kind":"sigma"}],"atlas_basic":[{"id":"atlas-basic-t1098-1","technique_id":"T1098","title":"T1098 Account Manipulation","kind":"basic","source_url":"https://1200km.com/anomaly-detection-atlas/attack-basic-detection-rule-catalog/#persistence","source_path":"docs/attack-basic-detection-rule-catalog.md","source_line":73,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-basic-detection-rule-catalog.md#L73","source_file_sha256":"396a87e3d8da74d170684c0f377fe5dc11cd1a486d4f2f89f7fbe94deaaa2a1e","source_row_sha256":"311f038c077b0faafd777d96a23ea2d659bcf6ed6c58ee1d708f2a8e2b47039f","validation":"published_concept_not_executable_or_live_validated","logic":"MATCH(credential_added OR role_added OR group_membership_changed) AND actor NOT_IN approved_identity_admins -> ALERT","log_sources":[{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Identity Provider Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#40-identity-provider-audit-logs"},{"title":"Cloud Identity and Access Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#105-cloud-identity-and-access-management-logs"}]}],"atlas_anomaly":[{"id":"atlas-anomaly-t1098-1","technique_id":"T1098","title":"Credential, group, role, or account-property modification — T1098 Account Manipulation","kind":"anomaly","source_url":"https://1200km.com/anomaly-detection-atlas/attack-statistical-anomaly-mapping/#account-manipulation","source_path":"docs/attack-statistical-anomaly-mapping.md","source_line":55,"pinned_source_url":"https://github.com/anpa1200/anomaly-detection-atlas/blob/e1f75007376022b2f596e413bea8612e514a5aa3/docs/attack-statistical-anomaly-mapping.md#L55","source_file_sha256":"9d38eaa6306863918e8193f267fb063270260e50b013928dc97893d5e74bf144","source_row_sha256":"f57e6c8538f67cca584d087af9440f6632c6dc1453bb0f6cba85a4122d80113b","validation":"published_concept_not_executable_or_live_validated","comparison_unit":"identity privilege graph.","expected_behavior":"privilege edges are created through known administrators and approved paths.","deviation":"new high-impact edge, uncommon path to privilege, or sudden graph restructuring.","anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Graph-Path-Length Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#74-graph-path-length-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"}],"log_sources":[{"title":"Directory-Service Audit Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#42-directory-service-audit-logs"},{"title":"Cloud Identity and Access Management Logs","url":"https://1200km.com/anomaly-detection-atlas/security-log-source-taxonomy/#105-cloud-identity-and-access-management-logs"}],"context_references":[{"title":"FortiGuard Incident Response Report H1 2023 — downloaded copy","url":"https://1200km.com/anomaly-detection-atlas/reports/cti-ir/fortiguard-ir-h1-2023.pdf"},{"title":"original source","url":"https://www.fortinet.com/content/dam/fortinet/assets/threat-reports/report-fortiguard-incident-response-1h-2023.pdf"}]}],"anomaly_types":[{"title":"Edge Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#69-edge-anomaly"},{"title":"Graph-Evolution Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#75-graph-evolution-anomaly"},{"title":"Graph-Path-Length Anomaly","url":"https://1200km.com/anomaly-detection-atlas/statistical-anomaly-taxonomy/#74-graph-path-length-anomaly"}],"strategies":[{"id":"DET0096","name":"Account Manipulation Behavior Chain Detection","url":"https://attack.mitre.org/detectionstrategies/DET0096","stix_id":"x-mitre-detection-strategy--d6c4cc3b-6875-4288-8193-bf4c864560ab","relationship_id":"relationship--94a27c31-1cda-4987-b42b-ed1868631177","description":"","analytics":[{"id":"AN0265","name":"Analytic 0265","guidance":"Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0265","platforms":["Windows"],"tuning":[{"field":"TimeWindow","description":"Time between suspicious process and account change (e.g., 5m)."},{"field":"HighPrivilegeGroupList","description":"Customize group list (e.g., Domain Admins, Enterprise Admins) to monitor."},{"field":"SubjectTargetMismatch","description":"Flag if account modifier != modified user (potential hijack)."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"WinEventLog:Security","channel":"EventCode=4738, 4728, 4670","platforms":["Windows"],"analytic_id":"AN0265","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0265","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0032","component":"Process Creation","name":"WinEventLog:Sysmon","channel":"EventCode=1","platforms":["Windows"],"analytic_id":"AN0265","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0265","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0032/"}]},{"id":"AN0266","name":"Analytic 0266","guidance":"Use of native tools or scripting (e.g., `usermod`, `passwd`, `groupmod`) to escalate permissions or persist access on existing users, correlated with login or process events.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0266","platforms":["Linux"],"tuning":[{"field":"SudoPath","description":"Common sudo or privilege escalation paths (e.g., `/usr/bin/passwd`)."},{"field":"ModifiedShellList","description":"Detect if user shell is changed to unusual one (e.g., /bin/sh -> /bin/bash)."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"auditd:SYSCALL","channel":"usermod, groupmod, passwd","platforms":["Linux"],"analytic_id":"AN0266","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0266","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"},{"component_id":"DC0061","component":"File Modification","name":"auditd:PATH","channel":"/etc/passwd or /etc/group file write","platforms":["Linux"],"analytic_id":"AN0266","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0266","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0061/"}]},{"id":"AN0267","name":"Analytic 0267","guidance":"Modifications to user accounts via `dscl`, `pwpolicy`, or System Preferences CLI (`sysadminctl`) that alter user groups, enable root, or bypass MDM restrictions.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0267","platforms":["macOS"],"tuning":[{"field":"ModifiedUserList","description":"Track known non-system user UIDs or service accounts."},{"field":"GroupMembershipChanges","description":"List of sensitive groups (admin, _developer, _analyticsd)."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"macos:unifiedlog","channel":"com.apple.accountsd, com.apple.opendirectoryd","platforms":["macOS"],"analytic_id":"AN0267","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0267","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]},{"id":"AN0268","name":"Analytic 0268","guidance":"Modifications to SSO/SAML user attributes (e.g., `isAdmin`, `role`, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0268","platforms":["Identity Provider"],"tuning":[{"field":"RoleAssignmentBaseline","description":"Expected user-role pairings per app or org unit."},{"field":"APIUsageContext","description":"Caller identity or IP address ranges for identity admin actions."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"saas:okta","channel":"User Attribute Modified / Role Assignment Changed","platforms":["Identity Provider"],"analytic_id":"AN0268","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0268","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]},{"id":"AN0269","name":"Analytic 0269","guidance":"Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0269","platforms":["ESXi"],"tuning":[{"field":"VMAdminAccountName","description":"Expected account name patterns for ESXi/vCenter admins."},{"field":"NetworkAccessLocation","description":"Expected IPs/subnets for legitimate ESXi access."}],"log_sources":[{"component_id":"DC0066","component":"Active Directory Object Modification","name":"esxi:vpxa","channel":"vim.SessionManager.login / vim.AccountManager.createUser","platforms":["ESXi"],"analytic_id":"AN0269","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0269","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0066/"}]},{"id":"AN0270","name":"Analytic 0270","guidance":"Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.","url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0270","platforms":["SaaS"],"tuning":[{"field":"SharingSensitivityLabel","description":"Threshold for labeling sensitive document access escalation."},{"field":"CrossOrgChanges","description":"Track changes made across organizational boundaries (e.g., guest users)."}],"log_sources":[{"component_id":"DC0010","component":"User Account Modification","name":"m365:unified","channel":"Admin Activity > Role Change or Sharing Change","platforms":["SaaS"],"analytic_id":"AN0270","source_url":"https://attack.mitre.org/detectionstrategies/DET0096#AN0270","validation":"upstream_definition_not_locally_validated","component_page":"telemetry/DC0010/"}]}]}],"telemetry_references":[{"id":"DC0066","name":"Active Directory Object Modification","tag":"Active Directory Object Modification","page":"telemetry/DC0066/","kind":"attack_component"},{"id":"DC0061","name":"File Modification","tag":"File Modification","page":"telemetry/DC0061/","kind":"attack_component"},{"id":"DC0032","name":"Process Creation","tag":"Process Creation","page":"telemetry/DC0032/","kind":"attack_component"},{"id":"DC0010","name":"User Account Modification","tag":"User Account Modification","page":"telemetry/DC0010/","kind":"attack_component"}],"visibility":"source_mapped","visibility_note":null,"tool_references":[{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"related_parent":null,"article_url":"https://1200km.com/articles/read/2026/2026-04-20-malicious-activity-as-a-statistical-signal-a-detection-engineering-analysis-of-anomaly-bas-90df8b6dea12/","validation":{"source_join":"exact_ids","sigma_yaml":"parsed","backend_compilation":"not_run","live_telemetry":"not_run","detection_execution":"not_run"}},"tools":[{"id":"S0002","name":"Mimikatz","page":"tools/S0002/","kind":"attack_tool","bases":["attack_uses"],"guides":[]}],"software":[{"id":"S0002","name":"Mimikatz","url":"https://attack.mitre.org/software/S0002","kind":"tool","description":"The [Mimikatz](https://attack.mitre.org/software/S0002) credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The <code>LSADUMP::ChangeNTLM</code> and <code>LSADUMP::SetNTLM</code> modules can also manipulate the password hash of an account without knowing the clear text value.(Citation: Adsecurity Mimikatz Guide)(Citation: Metcalf 2015)","relationship_id":"relationship--6e641c36-188b-480e-b177-e412cd000b34","references":[{"source_name":"Adsecurity Mimikatz Guide","description":"Metcalf, S. (2015, November 13). Unofficial Guide to Mimikatz & Command Reference. Retrieved December 23, 2015.","url":"https://adsecurity.org/?page_id=1821"},{"source_name":"Metcalf 2015","description":"Metcalf, S. (2015, January 19). Attackers Can Now Use Mimikatz to Implant Skeleton Key on Domain Controllers & BackDoor Your Active Directory Forest. Retrieved February 3, 2015.","url":"http://adsecurity.org/?p=1275"}]},{"id":"S0274","name":"Calisto","url":"https://attack.mitre.org/software/S0274","kind":"malware","description":"[Calisto](https://attack.mitre.org/software/S0274) adds permissions and remote logins to all users.(Citation: Symantec Calisto July 2018)","relationship_id":"relationship--fe56443a-5f0b-4120-9d27-d4d98aae69b8","references":[{"source_name":"Symantec Calisto July 2018","description":"Pantig, J. (2018, July 30). OSX.Calisto. Retrieved September 7, 2018.","url":"https://web.archive.org/web/20190111082249/https://www.symantec.com/security-center/writeup/2018-073014-2512-99?om_rssid=sr-latestthreats30days"}]},{"id":"S9008","name":"Shai-Hulud","url":"https://attack.mitre.org/software/S9008","kind":"malware","description":"[Shai-Hulud](https://attack.mitre.org/software/S9008) has modified GitHub account settings for private repositories and changed them to public.(Citation: Aikido Shai-Hulud September 2025)(Citation: Netskope Shai-Hulud November 2025)(Citation: Wiz Shai-Hulud September 2025)(Citation: Microsoft Shai-Hulud December 2025)","relationship_id":"relationship--98aa284c-7c8b-4577-9aed-5eaee1f1c787","references":[{"source_name":"Aikido Shai-Hulud September 2025","description":"Charlie Eriksen. (2025, September 16). S1ngularity/nx attackers strike again. Retrieved April 9, 2026.","url":"https://www.aikido.dev/blog/s1ngularity-nx-attackers-strike-again"},{"source_name":"Netskope Shai-Hulud November 2025","description":"Gianpietro Cutolo. (2025, November 26). Shai-Hulud 2.0: Aggressive, Automated, and Fast Spreading. Retrieved April 9, 2026.","url":"https://www.netskope.com/blog/shai-hulud-2-0-aggressive-automated-one-of-fastest-spreading-npm-supply-chain-attacks-ever-observed"},{"source_name":"Wiz Shai-Hulud September 2025","description":"Merav Bar, Rami McCarthy, Barak Sharoni. (2025, September 16). Shai-Hulud: Ongoing Package Supply Chain Worm Delivering Data-Stealing Malware. Retrieved April 9, 2026.","url":"https://www.wiz.io/blog/shai-hulud-npm-supply-chain-attack"},{"source_name":"Microsoft Shai-Hulud December 2025","description":"Microsoft Defender Security Team. (n.d.). Shai-Hulud 2.0: Guidance for detecting, investigating, and defending against the supply chain attack. Retrieved April 9, 2026.","url":"https://www.microsoft.com/en-us/security/blog/2025/12/09/shai-hulud-2-0-guidance-for-detecting-investigating-and-defending-against-the-supply-chain-attack/"}]}],"actors":[{"id":"G0032","name":"Lazarus Group","url":"https://attack.mitre.org/groups/G0032","kind":"intrusion-set","description":"[Lazarus Group](https://attack.mitre.org/groups/G0032) malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)","relationship_id":"relationship--2325c0b2-fb89-44e1-9206-e495811f2907","references":[{"source_name":"Novetta Blockbuster Destructive Malware","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Destructive Malware Report. Retrieved November 17, 2024.","url":"https://web.archive.org/web/20160303200515/https:/operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Destructive-Malware-Report.pdf"},{"source_name":"Novetta Blockbuster","description":"Novetta Threat Research Group. (2016, February 24). Operation Blockbuster: Unraveling the Long Thread of the Sony Attack. Retrieved February 25, 2016.","url":"https://web.archive.org/web/20160226161828/https://www.operationblockbuster.com/wp-content/uploads/2016/02/Operation-Blockbuster-Report.pdf"}]},{"id":"G0125","name":"HAFNIUM","url":"https://attack.mitre.org/groups/G0125","kind":"intrusion-set","description":"[HAFNIUM](https://attack.mitre.org/groups/G0125) has granted privileges to domain accounts and reset the password for default admin accounts.(Citation: Volexity Exchange Marauder March 2021)(Citation: Microsoft Silk Typhoon MAR 2025)","relationship_id":"relationship--d2edfaee-154b-4566-b85c-740e591477d9","references":[{"source_name":"Volexity Exchange Marauder March 2021","description":"Gruzweig, J. et al. (2021, March 2). Operation Exchange Marauder: Active Exploitation of Multiple Zero-Day Microsoft Exchange Vulnerabilities. Retrieved March 3, 2021.","url":"https://www.volexity.com/blog/2021/03/02/active-exploitation-of-microsoft-exchange-zero-day-vulnerabilities/"},{"source_name":"Microsoft Silk Typhoon MAR 2025","description":"Microsoft Threat Intelligence . (2025, March 5). Silk Typhoon targeting IT supply chain. Retrieved March 20, 2025.","url":"https://www.microsoft.com/en-us/security/blog/2025/03/05/silk-typhoon-targeting-it-supply-chain/"}]},{"id":"G1015","name":"Scattered Spider","url":"https://attack.mitre.org/groups/G1015","kind":"intrusion-set","description":"[Scattered Spider](https://attack.mitre.org/groups/G1015) has added accounts to the ESX Admins group to grant them full admin rights in vSphere.(Citation: Mandiant VMware vSphere JUL 2025)","relationship_id":"relationship--b7e52798-0764-4e01-b18a-81ec0d30c36f","references":[{"source_name":"Mandiant VMware vSphere JUL 2025","description":"Mandiant Incident Response. (2025, July 23). From Help Desk to Hypervisor: Defending Your VMware vSphere Estate from UNC3944. Retrieved October 13, 2025.","url":"https://cloud.google.com/blog/topics/threat-intelligence/defending-vsphere-from-unc3944"}]},{"id":"G1055","name":"VOID MANTICORE","url":"https://attack.mitre.org/groups/G1055","kind":"intrusion-set","description":"[VOID MANTICORE](https://attack.mitre.org/groups/G1055) has leveraged access to administrative control systems to achieve disruptive effects, consistent with administrative account abuse or privilege escalation within existing access.(Citation: Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026)(Citation: SEC 8K Palo Alto Statement Stryker Corp Handala March 2026)","relationship_id":"relationship--c4338a92-0adc-4d7e-a1ff-ab3cc321d914","references":[{"source_name":"Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026","description":"DomainTools Investigations. (2026, April 6). Handala: MOIS Linked Cyber Influence Ecosystem Threat Intelligence Assessment. Retrieved April 20, 2026.","url":"https://dti.domaintools.com/research/handala-mois-linked-cyber-influence-ecosystem-threat-intelligence-assessment"},{"source_name":"SEC 8K Palo Alto Statement Stryker Corp Handala March 2026","description":"Troy Bettencourt. (2026, March 20). SEC 8k: Stryker Corporation Partner and Customer Connections to the Stryker Environment. Retrieved April 20, 2026.","url":"https://www.sec.gov/Archives/edgar/data/310764/000119312526118634/d94012dex991.htm"}]},{"id":"G1056","name":"TeamPCP","url":"https://attack.mitre.org/groups/G1056","kind":"intrusion-set","description":"[TeamPCP](https://attack.mitre.org/groups/G1056) has modified settings to publish private Aqua Security repositories to GitHub as public.(Citation: Aqua Security Blog Trivy Compromise APR 2026)\n","relationship_id":"relationship--547d1be4-fc73-45e5-a7ff-0588e8bd050c","references":[{"source_name":"Aqua Security Blog Trivy Compromise APR 2026","description":"Aqua Team. (2026, April 1). Update: Ongoing Investigation and Continued Remediation. Retrieved July 1, 2026.","url":"https://www.aquasec.com/blog/trivy-supply-chain-attack-what-you-need-to-know"}]},{"id":"G1059","name":"NIMBUS MANTICORE","url":"https://attack.mitre.org/groups/G1059","kind":"intrusion-set","description":"[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has reset passwords of valid accounts to include domain accounts in order to obtain persistence and escalate privileges.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)     \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has reset passwords for domain controller accounts using `net.exe` through the command `net user DC-01$ P@ssw0rd`.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    \n\n[NIMBUS MANTICORE](https://attack.mitre.org/groups/G1059) has also abused Resource-Based Constrained Delegation (RBCD) assignments to impersonate high-privileged users and gain unauthorized access to services and resources.(Citation: Mandiant_UNC1549TTPsTools_Nov2025)    ","relationship_id":"relationship--2e451e48-c991-440d-b83c-320f709ceebd","references":[{"source_name":"Mandiant_UNC1549TTPsTools_Nov2025","description":"El-Banna, M., et al. (2025, November 17). Frontline Intelligence: Analysis of UNC1549 TTPs, Custom Tools, and Malware Targeting the Aerospace and Defense Ecosystem. Retrieved September 28, 2026.","url":"https://cloud.google.com/blog/topics/threat-intelligence/analysis-of-unc1549-ttps-targeting-aerospace-defense"}]}],"mitigations":[{"id":"M1018","name":"User Account Management","url":"https://attack.mitre.org/mitigations/M1018","kind":"course-of-action","description":"Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies.","relationship_id":"relationship--64628ae8-0bc8-428c-b7e5-1d738bc55e78","references":[]},{"id":"M1022","name":"Restrict File and Directory Permissions","url":"https://attack.mitre.org/mitigations/M1022","kind":"course-of-action","description":"Restrict access to potentially sensitive files that deal with authentication and/or authorization.","relationship_id":"relationship--6fd6a4ce-d14c-48ed-88c5-3997e67e0fd6","references":[]},{"id":"M1026","name":"Privileged Account Management","url":"https://attack.mitre.org/mitigations/M1026","kind":"course-of-action","description":"Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems.","relationship_id":"relationship--9ffc8525-79a5-40a2-b371-46052daf66c5","references":[]},{"id":"M1028","name":"Operating System Configuration","url":"https://attack.mitre.org/mitigations/M1028","kind":"course-of-action","description":"Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing.","relationship_id":"relationship--ff7f776f-001a-4c86-b359-08c89bd08b3e","references":[]},{"id":"M1030","name":"Network Segmentation","url":"https://attack.mitre.org/mitigations/M1030","kind":"course-of-action","description":"Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems.","relationship_id":"relationship--21ea4371-e692-4731-9f8c-c3f4dff3c775","references":[]},{"id":"M1032","name":"Multi-factor Authentication","url":"https://attack.mitre.org/mitigations/M1032","kind":"course-of-action","description":"Use multi-factor authentication for user and privileged accounts.","relationship_id":"relationship--74e433ec-0c52-42f2-b0d4-3e1f3a56b419","references":[]},{"id":"M1042","name":"Disable or Remove Feature or Program","url":"https://attack.mitre.org/mitigations/M1042","kind":"course-of-action","description":"Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible.","relationship_id":"relationship--45e8c03d-86f3-4cc0-907b-1e1d13960e43","references":[]}],"candidates":[{"id":"0e65ae27-5385-46b4-98ac-607a8ee82261","name":"Azure AD - adding user to Azure AD role","platforms":["azure-ad"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"The adversaries want to add user to some Azure AD role. Threat actor \nmay be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator, \nPrivileged Authentication Administrator (this role can reset Global Administrator password!).\nBy default, the role Global Reader is assigned to the user principal in this test.\n\nThe account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD.\n\nDetection hint - check Activity \"Add member to role\" in Azure AD Audit Logs. In targer you will also see User as a type.\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":"jonh@contoso.com"},"password":{"description":"Azure AD password","type":"string","default":"p4sswd"},"user_principal_name":{"description":"Display Name, or User Principal Name, of the targeted user principal","type":"string","default":"SuperUser"},"role_name":{"description":"Name of the targeted Azure AD role","type":"string","default":"Global Reader"}},"dependencies":[{"description":"AzureAD module must be installed.\n"}],"source_definition_sha256":"5225033646e3db01bb868263438e620cfca20137e2bd556cca4156d10a6fbcce"},{"id":"1a94b3fc-b080-450a-b3d8-6d9b57b472ea","name":"Azure - adding user to Azure role in subscription","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"The adversaries want to add user to some Azure role, also called Azure resource role. Threat actor \nmay be interested primarily in highly privileged roles, e.g. Owner, Contributor.\nBy default, the role Reader is assigned to user in this test.\n\nNew-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group.\n\nThe account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write \n(e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All \nand Microsoft Graph Directory.Read.All permissions.\n\nDetection hint - check Operation Name \"Create role assignment\" in subscriptions Activity Logs.\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":"jonh@contoso.com"},"password":{"description":"Azure AD password","type":"string","default":"p4sswd"},"user_principal_name":{"description":"Display Name, or User Principal Name, of the targeted user principal","type":"string","default":"SuperUser"},"role_name":{"description":"Name of the targeted Azure role","type":"string","default":"Reader"},"subscription":{"description":"Name of the targeted subscription","type":"string","default":"Azure subscription 1"}},"dependencies":[{"description":"Az.Resources module must be installed.\n"}],"source_definition_sha256":"152522fbed881e46350b8ba944e8b61f6d1ffd7bd029db68888643ad5eb91685"},{"id":"5598f7cb-cf43-455e-883a-f6008c5d46af","name":"Admin Account Manipulate","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":true,"dependency_count":0,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Manipulate Admin Account Name\n","inputs":{},"dependencies":[],"source_definition_sha256":"af5aeecee25afca0e3544fa149f33263f5e5b6556d00a500fe6478185b812bb0"},{"id":"68190529-069b-4ffc-a942-919704158065","name":"Domain Password Policy Check: No Number in Password","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default is long and has upper and lower case and special character but no number)","type":"string","default":"UpperLowerLong-special"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"4445e30c29cf4f1d9d28dda380d5740ca1ccaf6e525e67ad2a89fb792358e237"},{"id":"784d1349-5a26-4d20-af5e-d6af53bae460","name":"Domain Password Policy Check: Only Two Character Classes","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default has only upper and lower case characters)","type":"string","default":"onlyUPandLowChars"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"6e7b329f509ea192fe0f2be53f884a9cf82df81ec04a2d895bb6678f1ff47676"},{"id":"7d984ef2-2db2-4cec-b090-e637e1698f61","name":"Domain Password Policy Check: No Special Character in Password","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default is long and has upper and lower case and number but no special character)","type":"string","default":"UpperLowerLong333noSpecialChar"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"d3c209f037bd23c5207ec81514df94bf3ad691e99ee8dab8f16a4f9e2698e4d5"},{"id":"7ece1dea-49f1-4d62-bdcc-5801e3292510","name":"GCP - Delete Service Account Key","platforms":["iaas:gcp"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":4,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"This Atomic will: \n  - Create a service account\n  - Create a service account key, \n  - Store the result of retrieving a single key for that service account as a variable\n  - Pass that variable for deletion\n  - Delete the service account\n\nThe idea for this Atomic came from a Rule published by the Elastic team.\n\nIdentifies the deletion of an Identity and Access Management (IAM) service account key in Google Cloud Platform (GCP).\nEach service account is associated with two sets of public/private RSA key pairs that are used to authenticate. \nIf a key is deleted, the application will no longer be able to access Google Cloud resources using that key. A security best practice is to rotate your service account keys regularly.\n\nReference: https://github.com/elastic/detection-rules/blob/main/rules/integrations/gcp/impact_gcp_storage_bucket_deleted.toml\n","inputs":{"project_id":{"description":"ID of the GCP Project you to execute the command against.","type":"string","default":"atomic-test-1"},"service_name":{"description":"The name of the service account.","type":"string","default":"atomic-service-account"}},"dependencies":[{"description":"Requires gcloud\n"},{"description":"Check if user is logged in \n"},{"description":"Check if terraform is installed.\n"},{"description":"Create dependency resources using terraform\n"}],"source_definition_sha256":"a157d1304aa5d220ce95f01f67c52ee33c798bce98c61ad1f7409773f8dfbb00"},{"id":"81959d03-c51f-49a1-bb24-23f1ec885578","name":"Domain Password Policy Check: Common Password Use","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default is Season and current year combo)","type":"string","default":"Spring$((Get-Date).Year)!"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"dcb196c6bdabc1a7bf4ae6e74c71f4b8f07a4bdc6448630247ef6b5eadd31e9a"},{"id":"8822c3b0-d9f9-4daf-a043-49f110a31122","name":"AWS - Create a group and add a user to that group","platforms":["iaas:aws"],"method":"automated","executor":"sh","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Adversaries create AWS group, add users to specific to that group to elevate their privileges to gain more accesss\n","inputs":{"username":{"description":"Name of the AWS group to create","type":"string","default":"atomicredteam"}},"dependencies":[{"description":"Check if the user exists, we can only add a user to a group if the user exists.\n"}],"source_definition_sha256":"9344f298578aacd8471e687986452c2957b5b3583b4e33eec9096d04dcb5929c"},{"id":"92c40b3f-c406-4d1f-8d2b-c039bf5009e4","name":"Azure AD - adding service principal to Azure AD role","platforms":["azure-ad"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"The adversaries want to add service principal to some Azure AD role. Threat actor \nmay be interested primarily in highly privileged roles, e.g. Global Administrator, Application Administrator, \nPrivileged Authentication Administrator (this role can reset Global Administrator password!).\nBy default, the role Global Reader is assigned to service principal in this test.\n\nThe account you use to run the PowerShell command should have Privileged Role Administrator or Global Administrator role in your Azure AD.\n\nDetection hint - check Activity \"Add member to role\" in Azure AD Audit Logs. In targer you will also see Service Principal as a type.\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":"jonh@contoso.com"},"password":{"description":"Azure AD password","type":"string","default":"p4sswd"},"service_principal_name":{"description":"Name of the service principal","type":"string","default":"SuperSP"},"role_name":{"description":"Name of the targeted Azure AD role","type":"string","default":"Global Reader"}},"dependencies":[{"description":"AzureAD module must be installed.\n"}],"source_definition_sha256":"ffdee4a9f41628f27f47f61218228431a470b7a52bef573a1e640c09e61596e4"},{"id":"945da11e-977e-4dab-85d2-f394d03c5887","name":"Domain Password Policy Check: No Lowercase Character in Password","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default is long and has and upper case and special character and number but no lowercase)","type":"string","default":"UPPER-LONG-SPECIAL-333"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"87619c9ea682a55f53b13c39b336e1670464cab27175faf0a688bfebd9622242"},{"id":"94ea9cc3-81f9-4111-8dde-3fb54f36af4b","name":"Azure AD - adding permission to application","platforms":["azure-ad"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"The adversaries want to add permission to newly created application. Application could be then used for persistence or for further operation in the attacked infrastructure. Permissions like AppRoleAssignment.ReadWrite.All or RoleManagement.ReadWrite.Directory in particular can be a valuable target for a threat actor.\nThis technique will create a new app, with the provided name, and give it the provided permission. But if you prefer to add credentials to an existing app, replace in the code: \"Get-AzureADApplication\" instead of \"New-AzureADServicePrincipal\".\nThe DirectoryRecommendations.Read.All permissions has been selected as the default.\n\nThe account you use to run the PowerShell command should have Global Administrator/Application Administrator/Cloud Application Administrator role in your Azure AD.\n\nDetection hint - check Operation Name \"Add app role assignment to service principal\" in subscriptions Activity Logs.\nYou can also take a look at the materials:\nhttps://learnsentinel.blog/2022/01/04/azuread-privesc-sentinel/\nhttps://github.com/reprise99/Sentinel-Queries\nhttps://docs.google.com/presentation/d/1AWx1w0Xcq8ENvOmSjAJswEgEio-il09QWZlGg9PbHqE/edit#slide=id.g10460eb209c_0_2766\nhttps://gist.github.com/andyrobbins/7c3dd62e6ed8678c97df9565ff3523fb\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":"jonh@contoso.com"},"password":{"description":"Azure AD password","type":"string","default":"p4sswd"},"application_name":{"description":"Name of the targeted application that will be created","type":"string","default":"test_app"},"application_permission":{"description":"Permission from Microsoft Graph Resource API that will be added to application","type":"string","default":"DirectoryRecommendations.Read.All"}},"dependencies":[{"description":"AzureAD module must be installed.\n"}],"source_definition_sha256":"f2257e16b79089f9d5c48e9b3101ea10dca4fb2be1ac4622f982f4e90812fa04"},{"id":"a55a22e9-a3d3-42ce-bd48-2653adb8f7a9","name":"Domain Account and Group Manipulate","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins). \n\nThe quickest way to run it is against a domain controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,\nyou need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to \ncreate the user and alter the group. Automatic installation of the dependency requires an elevated session, \nand is unlikely to work with Powershell Core (untested).\n\nIf you consider running this test against a production Active Directory, the good practise is to create a dedicated\nservice account whose delegation is given onto a dedicated OU for user creation and deletion, as well as delegated\nas group manager of the target group.\n\nExample: `Invoke-AtomicTest -Session $session 'T1098' -TestNames \"Domain Account and Group Manipulate\" -InputArgs @{\"group\" = \"DNSAdmins\" }`\n","inputs":{"account_prefix":{"description":"Prefix string of the random username (by default, atr-). Because the cleanup deletes such account based on\na match `(&(samaccountname=#{account_prefix}-*)(givenName=Test))`, if you are to change it, be careful.\n","type":"string","default":"atr-"},"group":{"description":"Name of the group to alter","type":"string","default":"Domain Admins"},"create_args":{"description":"Additional string appended to New-ADUser call","type":"string","default":""}},"dependencies":[{"description":"PS Module ActiveDirectory\n"}],"source_definition_sha256":"85fa84bbc9d277c4442c0ca7081a1f16af5573f7f4bbd148c045473cf6b54ead"},{"id":"b299c120-44a7-4d68-b8e2-8ba5a28511ec","name":"Domain Password Policy Check: No Uppercase Character in Password","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password. You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was. \n","inputs":{"new_password":{"description":"The password to set for the current domain user (default is long and has and lower case and special character and number but no uppercase)","type":"string","default":"lower-long-special-333"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"343ad58551ceeb418a8795508985810cd4b1e6f017370dbafbd0b5bf7f1699e0"},{"id":"c8f4bc29-a151-48da-b3be-4680af56f404","name":"Azure - adding service principal to Azure role in subscription","platforms":["iaas:azure"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":true,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"The adversaries want to add service principal to some Azure role, also called Azure resource role. Threat actor \nmay be interested primarily in highly privileged roles, e.g. Owner, Contributor.\nBy default, the role Reader is assigned to service principal in this test.\n\nNew-AzRoleAssignment cmdlet could be also use to assign user/service principal to resource, resource group and management group.\n\nThe account you use to run the PowerShell command must have Microsoft.Authorization/roleAssignments/write \n(e.g. such as User Access Administrator or Owner) and the Azure Active Directory Graph Directory.Read.All \nand Microsoft Graph Directory.Read.All permissions.\n\nDetection hint - check Operation Name \"Create role assignment\" in subscriptions Activity Logs.\n","inputs":{"username":{"description":"Azure AD username","type":"string","default":"jonh@contoso.com"},"password":{"description":"Azure AD password","type":"string","default":"p4sswd"},"service_principal_name":{"description":"Name of the service principal","type":"string","default":"SuperSP"},"role_name":{"description":"Name of the targeted Azure role","type":"string","default":"Reader"},"subscription":{"description":"Name of the targeted subscription","type":"string","default":"Azure subscription 1"}},"dependencies":[{"description":"Az.Resources module must be installed.\n"}],"source_definition_sha256":"cd661b881689f2d397319a24b2840d65f8a823a64594117bbd7ce2a010025e71"},{"id":"d5b886d9-d1c7-4b6e-a7b0-460041bf2823","name":"Password Change on Directory Service Restore Mode (DSRM) Account","platforms":["windows"],"method":"automated","executor":"command_prompt","elevation_required":true,"dependency_count":0,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Change the password on the Directory Service Restore Mode (DSRM) account using ntdsutil by syncing to existing account\n","inputs":{"sync_account":{"description":"Account to sync password from","type":"string","default":"%username%"}},"dependencies":[],"source_definition_sha256":"7703f33e4cbb189ab37926ab616bd52cb6b918491fd43b5ea20d4f9ea92f58fc"},{"id":"fc5f9414-bd67-4f5f-a08e-e5381e29cbd1","name":"Domain Password Policy Check: Short Password","platforms":["windows"],"method":"automated","executor":"powershell","elevation_required":false,"dependency_count":1,"cleanup_defined":false,"review_status":"not_individually_reviewed","source_url":"https://github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1098/T1098.yaml","description":"Attempt to change the password of the current domain user in order to check password policy. Ideally, you would only run this atomic test to verify that your password policy is blocking the use of the new password.\nIf the password is succesfully changed to the new password, the credential file will be updated to reflect the new password.  You can then run the atomic manually and specify a new password of your choosing, however the\npassword policy will likely prevent you from setting the password back to what it was.\n","inputs":{"new_password":{"description":"The password to set for the current domain user (default value is 7 characters)","type":"string","default":"Uplow-1"},"cred_file":{"description":"A file containing the password of the current user","type":"path","default":"$env:LOCALAPPDATA\\AtomicRedTeam\\$env:USERNAME.txt"}},"dependencies":[{"description":"Password for current user must be stored in a credential file\n"}],"source_definition_sha256":"b1608b4ba41fc499bdb943c72fe35d468b2186c3fee54cfa7234bc37ce8b92da"}],"simulation":{"atomic_status":"documented_candidate","lab_execution":"not_run","browser_attack_runner":false,"prerequisites":"Use disposable lab hosts and test accounts, explicit target allowlists, a clean snapshot, bounded egress and a restore plan. Review every candidate and dependency before any execution.","scenario":null},"validation":{"source_identity":"checked_against_pinned_source","relationship_join":"exact_ids_no_inheritance","page_contract":"automated_checks_required","sensor_capture":"not_run","detection_backend":"not_run","adversary_simulation":"not_run","independent_incident_fact_check":"not_performed"},"technique_links":{"T1078":"/ttp-simulation/techniques/enterprise/T1078/","T1098":"/ttp-simulation/techniques/enterprise/T1098/"},"synthetic":{"schema":"1200km.ttp.collection-fixture.v1","synthetic":true,"technique_key":"enterprise/T1098","purpose":"Collection/parser contract exercise, NOT a positive example or detection of this TTP.","events":[{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0066","collector":"illustrative-lab-collector","observation":{"object_dn":"CN=LabUser,OU=Lab,DC=example,DC=test","attribute":"description","before":"Lab account","after":"Lab account reviewed"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0061","collector":"illustrative-lab-collector","observation":{"path":"C:\\Lab\\demo.txt","attribute":"content_hash","before":"aaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaaa","after":"bbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbbb"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0032","collector":"illustrative-lab-collector","observation":{"process_guid":"lab-process-001","image":"C:\\Windows\\System32\\whoami.exe","parent_image":"C:\\Windows\\System32\\cmd.exe","command_line":"whoami","user":"LAB\\analyst"}},{"schema":"1200km.telemetry.example.v1","synthetic":true,"timestamp":"2026-09-27T12:00:00Z","telemetry_id":"DC0010","collector":"illustrative-lab-collector","observation":{"target_account":"lab-temp","attribute":"enabled","before":false,"after":true}}]}}