type: attack-pattern
spec_version: 2.1
id: attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27
created: 2017-05-31T21:31:12.196Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/techniques/T1098
external_id: T1098
source_name: FireEye SMOKEDHAM June 2021
description: FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.
url: https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html
source_name: Microsoft Security Event 4670
description: Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.
url: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670
source_name: Microsoft User Modified Event
description: Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.
url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
source_name: InsiderThreat ChangeNTLM July 2017
description: Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.
url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
source_name: GitHub Mimikatz Issue 92 June 2017
description: Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.
url: https://github.com/gentilkiwi/mimikatz/issues/92
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-10-24T17:49:10.273Z
name: Account Manipulation
description: Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. 

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
kill_chain_phases: kill_chain_name: mitre-attack
phase_name: persistence
kill_chain_name: mitre-attack
phase_name: privilege-escalation
x_mitre_attack_spec_version: 3.2.0
x_mitre_contributors: Jannie Li, Microsoft Threat Intelligence Center (MSTIC)
Praetorian
Tim MalcomVetter
Wojciech Lesicki
Arad Inbar, Fidelis Security
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_is_subtechnique: no
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_platforms: Containers
ESXi
IaaS
Identity Provider
Linux
macOS
Network Devices
Office Suite
SaaS
Windows
x_mitre_version: 2.8