T1098 Account Manipulation — Detection Rules

Source-backed rule directory

• Bitbucket Global Permission Changed · test · medium · {"product":"bitbucket","service":"audit","definition":"Requirements: \"Advance\" log level is required to receive these audit events."}
• AWS IAM Backdoor Users Keys · test · medium · {"product":"aws","service":"cloudtrail"}
• AWS Route 53 Domain Transfer Lock Disabled · test · low · {"product":"aws","service":"cloudtrail"}
• AWS Route 53 Domain Transferred to Another Account · test · low · {"product":"aws","service":"cloudtrail"}
• AWS User Login Profile Was Modified · test · high · {"product":"aws","service":"cloudtrail"}
• Number Of Resource Creation Or Deployment Activities · test · medium · {"product":"azure","service":"activitylogs"}
• Change to Authentication Method · test · medium · {"product":"azure","service":"auditlogs"}
• Bulk Deletion Changes To Privileged Account Permissions · test · high · {"product":"azure","service":"auditlogs"}
• Anomalous User Activity · test · high · {"product":"azure","service":"riskdetection"}
• GCP Access Policy Deleted · test · medium · {"product":"gcp","service":"gcp.audit"}
• Google Workspace Granted Domain API Access · test · medium · {"product":"gcp","service":"google_workspace.admin"}
• Google Workspace User Granted Admin Privileges · test · medium · {"product":"gcp","service":"google_workspace.admin"}
• Privileged User Has Been Created · test · high · {"product":"linux","definition":"/var/log/secure on REHL systems or /var/log/auth.log on debian like Systems needs to be collected in order for this detection to work"}
• ESXi Admin Permission Assigned To Account Via ESXCLI · test · high · {"category":"process_creation","product":"linux"}
• Cisco Local Accounts · test · high · {"product":"cisco","service":"aaa"}
• A Member Was Added to a Security-Enabled Global Group · stable · low · {"product":"windows","service":"security"}
• A Member Was Removed From a Security-Enabled Global Group · stable · low · {"product":"windows","service":"security"}
• A Security-Enabled Global Group Was Deleted · stable · low · {"product":"windows","service":"security"}
• Powerview Add-DomainObjectAcl DCSync AD Extend Right · test · high · {"product":"windows","service":"security","definition":"Requirements: The \"Audit Directory Service Changes\" logging policy must be configured in order to receive events. Audit events are generated only for objects with configured system access control lists (SACLs). Audit events are generated only for objects with configured system access control lists (SACLs) and only when accessed in a manner that matches their SACL settings. This policy covers the following events ids - 5136, 5137, 5138, 5139, 5141. Note that the default policy does not cover User objects. For that a custom AuditRule need to be setup (See https://github.com/OTRF/Set-AuditRule)"}
• Enabled User Right in AD to Control User Objects · test · high · {"product":"windows","service":"security","definition":"Requirements: Audit Policy : Policy Change > Audit Authorization Policy Change, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Policy Change\\Audit Authorization Policy Change"}
• Active Directory User Backdoors · test · high · {"product":"windows","service":"security","definition":"Requirements: Audit Policy : Account Management > Audit User Account Management, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\Account Management\\Audit User Account Management, DS Access > Audit Directory Service Changes, Group Policy : Computer Configuration\\Windows Settings\\Security Settings\\Advanced Audit Policy Configuration\\Audit Policies\\DS Access\\Audit Directory Service Changes"}
• A New Trust Was Created To A Domain · stable · medium · {"product":"windows","service":"security"}
• Password Change on Directory Service Restore Mode (DSRM) Account · stable · high · {"product":"windows","service":"security"}
• User Added to Local Administrator Group · stable · medium · {"product":"windows","service":"security"}
• DMSA Service Account Created in Specific OUs - PowerShell · experimental · medium · {"category":"ps_script","product":"windows"}
• Powershell LocalAccount Manipulation · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• DMSA Link Attributes Modified · experimental · low · {"category":"ps_script","product":"windows"}
• New DMSA Service Account Created in Specific OUs · experimental · medium · {"category":"process_creation","product":"windows"}
• User Added to Local Administrators Group · test · medium · {"category":"process_creation","product":"windows"}
• User Added To Highly Privileged Group · test · high · {"category":"process_creation","product":"windows"}
• Password Set to Never Expire via WMI · experimental · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1098 Account Manipulation

MATCH(credential_added OR role_added OR group_membership_changed) AND actor NOT_IN approved_identity_admins -> ALERT

• Directory-Service Audit Logs
• Identity Provider Audit Logs
• Cloud Identity and Access Management Logs
• Atlas source section

Anomaly models

ATT&CK analytic guidance

DET0096 Account Manipulation Behavior Chain Detection

AN0265 Analytic 0265

Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.

AN0266 Analytic 0266

Use of native tools or scripting (e.g., `usermod`, `passwd`, `groupmod`) to escalate permissions or persist access on existing users, correlated with login or process events.

AN0267 Analytic 0267

Modifications to user accounts via `dscl`, `pwpolicy`, or System Preferences CLI (`sysadminctl`) that alter user groups, enable root, or bypass MDM restrictions.

AN0268 Analytic 0268

Modifications to SSO/SAML user attributes (e.g., `isAdmin`, `role`, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.

AN0269 Analytic 0269

Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.

AN0270 Analytic 0270

Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.