type: x-mitre-data-component
spec_version: 2.1
id: x-mitre-data-component--d27b0089-2c39-4b6c-84ff-303e48657e77
created: 2021-10-20T15:05:19.271Z
created_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
revoked: no
external_references: source_name: mitre-attack
url: https://attack.mitre.org/datacomponents/DC0010
external_id: DC0010
object_marking_refs: marking-definition--fa42a846-8d90-4e51-bc29-71d5b4802168
modified: 2025-11-12T22:03:39.105Z
name: User Account Modification
description: Changes made to an existing user, service, or machine account, including alterations to attributes, permissions, roles, authentication methods, or group memberships.
x_mitre_modified_by_ref: identity--c78cb6e5-0c4b-4611-8297-d1b8b55e40b5
x_mitre_deprecated: no
x_mitre_domains: enterprise-attack
x_mitre_version: 2.0
x_mitre_attack_spec_version: 3.3.0
x_mitre_log_sources: name: azure:audit
channel: Operation IN ("Add device", "Add registered users to device", "Add registered owner to device")
name: linux:syslog
channel: sudo or su access prior to content change
name: WinEventLog:Security
channel: EventCode=4738, 4728, 4670
name: auditd:SYSCALL
channel: usermod, groupmod, passwd
name: macos:unifiedlog
channel: com.apple.accountsd, com.apple.opendirectoryd
name: saas:okta
channel: User Attribute Modified / Role Assignment Changed
name: m365:unified
channel: Admin Activity > Role Change or Sharing Change
name: gcp:audit
channel: Admin Activity > Role Change or Sharing Change
name: m365:unified
channel: Set-ADUser OR Set-ADAccountControl
name: AWS:CloudTrail
channel: UpdateLoginProfile
name: WinEventLog:Security
channel: EventCode=4723, 4724, 4740
name: saas:okta
channel: user.lifecycle.delete, user.account.lock
name: m365:unified
channel: User excluded from MFA or MFA method registered
name: saas:zoom
channel: DisableMFA or RegisterNewFactor
name: AWS:CloudTrail
channel: AttachUserPolicy, CreatePolicyVersion, PutRolePolicy
name: gcp:audit
channel: google.iam.admin.v1.RoleAssignment
name: m365:audit
channel: Add member to role, Add app role assignment
name: Okta:SystemLog
channel: user.account.privilege.grant
name: m365:unified
channel: Add member to role, Set-Mailbox
name: m365:unified
channel: Set-MailboxAuditBypassAssociation or disabling Advanced Auditing
name: m365:unified
channel: New agent registration by non-admin user
name: WinEventLog:Security
channel: EventCode=4704
name: WinEventLog:Security
channel: EventCode=4728, 4729, 4732, 4733, 4756, 4757
name: auditd:SYSCALL
channel: SYSCALL for usermod or /etc/group file modification
name: macos:unifiedlog
channel: Process execution or directory service changes
name: azure:policy
channel: DisableMfaPolicy or change to ConditionalAccess rules
name: azure:audit
channel: Add member to role
name: AWS:CloudTrail
channel: AttachUserPolicy
name: AWS:CloudTrail
channel: CreateAccessKey
name: azure:signinlogs
channel: unusual role assumption or elevation path
name: saas:okta
channel: admin role granted outside approved workflows
name: AWS:CloudTrail
channel: role privilege expansion detected
name: m365:unified
channel: Add-MailboxPermission, UpdateFolderPermissions
name: gcp:audit
channel: Set Gmail Delegation
name: auditd:SYSCALL
channel: usermod, or account rename system calls
name: azure:audit
channel: Rename user
name: m365:unified
channel: Set-Mailbox, Set-InboxRule, Set-MailboxFolderPermission
name: azure:audit
channel: Add service principal credentials, app password added, app role assignment
name: gcp:audit
channel: iam.serviceAccounts.keys.create, os-login.sshPublicKeys.add
name: gcp:audit
channel: API Key Created, OAuth Client Registered
name: kubernetes:audit
channel: create or update events for RoleBinding or ClusterRoleBinding objects