Overview

MITRE ATT&CK T1098 (Account Manipulation) covers adversary actions to maintain or expand access to compromised accounts, including adding credentials, modifying group memberships, SID history injection, and creating shadow admin accounts. This skill covers detecting these techniques through Windows Security Event Log analysis (Event IDs 4738, 4728, 4732, 4756, 4670, 5136), correlating group membership changes with privilege escalation indicators, and identifying anomalous account modification patterns.

When to Use

When investigating security incidents that require hunting for t1098 account manipulation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Windows Security Event Logs (EVTX format) or SIEM access
Python 3.9+ with python-evtx, lxml libraries
Understanding of Active Directory group structure and SID architecture

Overview

When to Use

When investigating security incidents that require hunting for t1098 account manipulation
When building detection rules or threat hunting queries for this domain
When SOC analysts need structured procedures for this analysis type
When validating security monitoring coverage for related attack techniques

Prerequisites

Windows Security Event Logs (EVTX format) or SIEM access
Python 3.9+ with python-evtx, lxml libraries
Understanding of Active Directory group structure and SID architecture

Hunting For T1098 Account Manipulation

Overview

When to Use

Prerequisites

Hunting For T1098 Account Manipulation

Overview

When to Use

Prerequisites

Steps

Step 1: Parse Account Modification Events

Step 2: Detect Privileged Group Changes

Step 3: Identify Shadow Admin Indicators

Step 4: Correlate with Attack Timeline

Expected Output

Mcporter

Sonoscli

Openhue

Healthcheck

Things Mac

Eightctl