CmdID

CmdID / Techniques

T1098 Account Manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. MITRE ATT&CK

6 Sigma rules T1098 on attack.mitre.org

Sigma rules tagged with it

process creation, the highest levels first
highESXi Admin Permission Assigned To Account Via ESXCLINasreddine Bencherchali (Nextron Systems) · Linux
highHackTool - GoldenDMSA ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
highUser Added To Highly Privileged GroupNasreddine Bencherchali (Nextron Systems) · Windows
mediumNew DMSA Service Account Created in Specific OUsSwachchhanda Shrawan Poudel (Nextron Systems) · Windows
mediumPassword Set to Never Expire via WMIDaniel Koifman (KoifSec) · Windows
mediumUser Added to Local Administrators GroupFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows