Account Manipulation

Account manipulation covers an attacker modifying an existing account's properties or permissions, most commonly by adding it to a privileged group, rather than creating a brand-new account from scratch.

This is frequently preferred over creating a new account because it's less conspicuous. A new account creation is itself an event worth noticing; quietly expanding what an existing, already-legitimate-looking account can do often draws far less attention.

With sufficient privilege, an attacker adds an account they already control, whether a compromised legitimate account or a service account, to a group that grants broader access: domain administrators, local administrators, or another privileged role.

This is frequently a persistence and privilege-escalation move at the same time. Even if the attacker's original point of entry is later discovered and closed, the modified account keeps its expanded privileges until someone specifically notices and reverts the change, which can take far longer than noticing a wholly new account.

Data source: Windows Security event log, group management events

{
  "user": {
    "name": "svc_helper"
  },
  "event": {
    "action": "added-member-to-group"
  },
  "group": {
    "name": "Domain Admins"
  },
  "winlog": {
    "event_data": {
      "SubjectUserName": "j.doe"
    }
  }
}

Prebuilt Elastic rule: User Added to Privileged Group in Active Directory

Filter group-membership-change events for privileged group targets specifically (domain admins and equivalent), then look at who performed the change and whether that administrator's own activity fits their normal pattern. A single addition is not inherently suspicious; the account being added, and whether it has any legitimate reason for that level of access, is what matters.

Correlate with the timeline: a privilege change shortly after an unusual login on the account doing the adding, or a change to an account that was itself recently created or compromised, is a much stronger signal than the group change in isolation.

Legitimate administrative work adds and removes people from privileged groups constantly: promotions, role changes, project-based access, and routine account administration.

The distinguishing signal is whether the change fits the pattern of how privilege is normally granted in that environment: through a known administrator, following a recognizable process, to an account that plausibly needs it. An unfamiliar administrator account making the change, or a change to an account with no obvious business reason for elevated access, is what's worth investigating.

• MITRE ATT&CK: T1098 Account Manipulation
• Elastic Security: User Added to Privileged Group in Active Directory

1 scenario in this catalog covers T1098. We don't name it — identifying the technique is part of what a scenario grades. Explore the dashboard →