T1098

Account Manipulation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. Account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

Microsoft Sentinel / Defender

kusto

// T1098 — Account Manipulation: Detects suspicious account property changes, privilege assignments, and group membership modifications
let SensitiveGroups = dynamic(["Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators", "Account Operators", "Backup Operators", "Print Operators", "Server Operators", "Group Policy Creator Owners", "Remote Management Users", "ESX Admins"]);
let LookbackWindow = 1d;
union
(
    // 4738 - User account changed (password reset, UserAccountControl changes, etc.)
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4738
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "UserAccountModified"
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4670 - Account permissions changed
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4670
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "PermissionsChanged"
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4732 - Member added to security-enabled local group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4732
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4728 - Member added to security-enabled global group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4728
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToGlobalGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4756 - Member added to security-enabled universal group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4756
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToUniversalGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4648 - Logon using explicit credentials after account change (potential Skeleton Key)
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4648
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "ExplicitCredentialLogon"
    | where SubjectUserName != TargetUserName
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
)
| summarize EventCount=count(), EventTypes=make_set(ChangeType), AffectedAccounts=make_set(TargetAccount), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ChangedBy, Computer
| where EventCount >= 1
| extend RiskScore = case(
    EventCount >= 10, "High",
    EventCount >= 3, "Medium",
    "Low"
  )
| sort by EventCount desc

high severity high confidence

Data Sources

User Account: User Account Modification Active Directory: Active Directory Object Modification Windows Security Event Log

Required Tables

SecurityEvent

False Positives

IT administrators performing legitimate account provisioning or group membership changes during onboarding or role transitions
Automated identity management systems (SailPoint, Saviynt, AD Connect) performing scheduled sync operations that generate bulk account modification events
Help desk staff performing password resets or account unlock operations which generate 4738 events
Group Policy or SCCM deployments that modify local group membership across endpoints as part of standard configuration management
Scheduled account maintenance scripts that iterate through stale accounts and modify their properties

Splunk

spl

index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4738 OR EventCode=4670 OR EventCode=4732 OR EventCode=4728 OR EventCode=4756 OR EventCode=4735 OR EventCode=4648)
| eval ChangeType=case(
    EventCode=4738, "UserAccountModified",
    EventCode=4670, "PermissionsChanged",
    EventCode=4732, "AddedToLocalGroup",
    EventCode=4728, "AddedToGlobalGroup",
    EventCode=4756, "AddedToUniversalGroup",
    EventCode=4735, "LocalGroupModified",
    EventCode=4648, "ExplicitCredentialLogon",
    "Unknown"
  )
| eval SensitiveGroup=if(match(lower(coalesce(TargetUserName, Group_Name, "")), "domain admins|enterprise admins|schema admins|administrators|account operators|backup operators|server operators|group policy creator owners|remote management users|esx admins"), 1, 0)
| eval IsHighRisk=if(SensitiveGroup=1 OR EventCode=4670, 1, 0)
| eval ActorAccount=coalesce(SubjectUserName, Subject_Account_Name, "Unknown")
| eval TargetAccount=coalesce(TargetUserName, Target_Account_Name, MemberName, "Unknown")
| eval TargetDomain=coalesce(TargetDomainName, "Unknown")
| where NOT (ActorAccount="-" OR ActorAccount="SYSTEM" OR ActorAccount="LOCAL SERVICE" OR ActorAccount="NETWORK SERVICE")
| stats count as TotalEvents,
        sum(IsHighRisk) as HighRiskCount,
        values(ChangeType) as ChangeTypes,
        values(TargetAccount) as AffectedAccounts,
        earliest(_time) as FirstSeen,
        latest(_time) as LastSeen
        by ActorAccount, host
| eval RiskScore=case(
    HighRiskCount >= 3, "Critical",
    HighRiskCount >= 1, "High",
    TotalEvents >= 10, "Medium",
    "Low"
  )
| where TotalEvents >= 1
| sort - HighRiskCount, - TotalEvents

high severity high confidence

Data Sources

User Account: User Account Modification Active Directory: Active Directory Object Modification Windows Security Event Log

Required Sourcetypes

WinEventLog:Security

False Positives

IT administrators performing legitimate account provisioning or group membership changes during onboarding or role transitions
Automated identity management systems (SailPoint, Saviynt, AD Connect) performing scheduled sync operations that generate bulk account modification events
Help desk staff performing password resets or account unlock operations which generate 4738 events
Group Policy or SCCM deployments that modify local group membership across endpoints as part of standard configuration management
Scheduled account maintenance scripts that iterate through stale accounts and modify their properties

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  LONG(eventid) AS EventID,
  CASE
    WHEN LONG(eventid) = 4738 THEN 'UserAccountModified'
    WHEN LONG(eventid) = 4670 THEN 'PermissionsChanged'
    WHEN LONG(eventid) = 4732 THEN 'AddedToLocalGroup'
    WHEN LONG(eventid) = 4728 THEN 'AddedToGlobalGroup'
    WHEN LONG(eventid) = 4756 THEN 'AddedToUniversalGroup'
    WHEN LONG(eventid) = 4735 THEN 'LocalGroupModified'
    WHEN LONG(eventid) = 4648 THEN 'ExplicitCredentialLogon'
    ELSE 'Unknown'
  END AS ChangeType,
  username AS ActorAccount,
  "Account_Domain" AS TargetDomain,
  "Target_Account_Name" AS TargetAccount,
  hostname AS SourceHost,
  CATEGORYNAME(category) AS EventCategory,
  LOGSOURCENAME(logsourceid) AS LogSource,
  COUNT(*) OVER (PARTITION BY username, hostname) AS ActorEventCount
FROM events
WHERE
  LOGSOURCETYPEID = 12
  AND LONG(eventid) IN (4738, 4670, 4732, 4728, 4756, 4735, 4648)
  AND username NOT IN ('-', 'SYSTEM', 'LOCAL SERVICE', 'NETWORK SERVICE', 'ANONYMOUS LOGON')
  AND (
    LONG(eventid) IN (4738, 4670, 4648)
    OR (
      LONG(eventid) IN (4732, 4728, 4756, 4735)
      AND (LOWER("Group_Name") LIKE '%domain admins%'
        OR LOWER("Group_Name") LIKE '%enterprise admins%'
        OR LOWER("Group_Name") LIKE '%schema admins%'
        OR LOWER("Group_Name") LIKE '%administrators%'
        OR LOWER("Group_Name") LIKE '%account operators%'
        OR LOWER("Group_Name") LIKE '%backup operators%'
        OR LOWER("Group_Name") LIKE '%server operators%'
        OR LOWER("Group_Name") LIKE '%group policy creator owners%'
        OR LOWER("Group_Name") LIKE '%remote management users%'
        OR LOWER("Group_Name") LIKE '%esx admins%')
    )
  )
LAST 24 HOURS
ORDER BY ActorEventCount DESC, starttime DESC

high severity high confidence

Data Sources

Windows Security Event Log (LOGSOURCETYPEID=12) Active Directory Domain Controllers Windows member servers with audit policy enabled

Required Tables

events

False Positives

Enterprise identity governance platforms (e.g., Saviynt, CyberArk, Varonis) performing automated access certification reviews that add/remove sensitive group memberships in bulk
Domain administrator accounts performing legitimate bulk user provisioning during company mergers, acquisitions, or large-scale onboarding events — results in a spike of 4738 and 4732 events from a single actor
Password synchronization tools or SSO federation agents generating 4648 explicit credential logon events during token refresh cycles, which can appear as repeated credential use across many accounts

Sumo Logic CSE

sql

_sourceCategory=Windows/Security ("EventCode=4738" OR "EventCode=4670" OR "EventCode=4732" OR "EventCode=4728" OR "EventCode=4756" OR "EventCode=4735" OR "EventCode=4648")
| parse "EventCode=*" as EventCode
| parse "SubjectUserName=*" as ActorAccount nodrop
| parse "TargetUserName=*" as TargetAccount nodrop
| parse "TargetDomainName=*" as TargetDomain nodrop
| parse "MemberName=%CN=*," as MemberCN nodrop
| parse "Computer=*" as SourceHost nodrop
| where !(ActorAccount matches "-" or ActorAccount matches "SYSTEM" or ActorAccount matches "LOCAL SERVICE" or ActorAccount matches "NETWORK SERVICE")
| eval ChangeType = if(EventCode == "4738", "UserAccountModified",
    if(EventCode == "4670", "PermissionsChanged",
    if(EventCode == "4732", "AddedToLocalGroup",
    if(EventCode == "4728", "AddedToGlobalGroup",
    if(EventCode == "4756", "AddedToUniversalGroup",
    if(EventCode == "4735", "LocalGroupModified",
    if(EventCode == "4648", "ExplicitCredentialLogon", "Unknown")))))))
| eval IsSensitiveGroup = if(
    matches(toLowerCase(TargetAccount), ".*domain admins.*") or
    matches(toLowerCase(TargetAccount), ".*enterprise admins.*") or
    matches(toLowerCase(TargetAccount), ".*schema admins.*") or
    matches(toLowerCase(TargetAccount), ".*administrators.*") or
    matches(toLowerCase(TargetAccount), ".*account operators.*") or
    matches(toLowerCase(TargetAccount), ".*backup operators.*") or
    matches(toLowerCase(TargetAccount), ".*server operators.*") or
    matches(toLowerCase(TargetAccount), ".*group policy creator owners.*") or
    matches(toLowerCase(TargetAccount), ".*remote management users.*") or
    matches(toLowerCase(TargetAccount), ".*esx admins.*"), 1, 0)
| eval IsHighRisk = if(IsSensitiveGroup == 1 OR EventCode == "4670", 1, 0)
| stats count as TotalEvents,
        sum(IsHighRisk) as HighRiskCount,
        values(ChangeType) as ChangeTypes,
        values(TargetAccount) as AffectedAccounts,
        min(_messageTime) as FirstSeen,
        max(_messageTime) as LastSeen
        by ActorAccount, SourceHost
| eval RiskScore = if(HighRiskCount >= 3, "Critical",
    if(HighRiskCount >= 1, "High",
    if(TotalEvents >= 10, "Medium", "Low")))
| where TotalEvents >= 1
| sort by HighRiskCount, TotalEvents

high severity high confidence

Data Sources

Windows Security Event Log via Sumo Logic Installed Collector Active Directory Domain Controllers Windows servers with advanced audit policy configured

Required Tables

_sourceCategory=Windows/Security Windows event log messages forwarded via Sumo Logic collector

False Positives

Privileged Access Workstation (PAW) administrators performing legitimate just-in-time (JIT) access assignments that temporarily add accounts to sensitive groups like Domain Admins, which generates 4728/4732/4756 events followed by rapid removal events
IT operations teams running automated compliance scripts that audit and correct group memberships — these produce clusters of account modification events from a single service account across many targets in a short window
SCCM/MECM or Intune enrollment processes that modify local Administrators group membership on endpoints, generating high volumes of 4732 events from domain controller service accounts

Google Chronicle / SecOps

yaral

rule T1098_Account_Manipulation {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects T1098 Account Manipulation via Windows Security Events monitoring account property changes, permission modifications, and sensitive group membership additions."
    mitre_attack_tactic = "Persistence, Privilege Escalation"
    mitre_attack_technique = "T1098"
    severity = "HIGH"
    priority = "HIGH"
    version = "1.0"

  events:
    $e.metadata.log_type = "WINEVTLOG"
    $e.metadata.vendor_name = "Microsoft"
    $e.metadata.product_name = "Windows"
    $e.metadata.product_event_type in [
      "4738", "4670", "4732", "4728", "4756", "4735", "4648"
    ]
    not $e.principal.user.userid in [
      "-", "SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "ANONYMOUS LOGON"
    ]
    not re.regex($e.principal.user.userid, `\$$`)
    (
      $e.metadata.product_event_type in ["4738", "4670", "4648"]
      or
      (
        $e.metadata.product_event_type in ["4732", "4728", "4756", "4735"]
        and
        re.regex($e.target.group.group_display_name,
          `(?i)(domain admins|enterprise admins|schema admins|^administrators$|account operators|backup operators|print operators|server operators|group policy creator owners|remote management users|esx admins)`
        )
      )
    )
    $actor = $e.principal.user.userid
    $host = $e.principal.hostname

  match:
    $actor, $host over 1h

  outcome:
    $event_count = count_distinct($e.metadata.id)
    $event_types = array_distinct($e.metadata.product_event_type)
    $affected_accounts = array_distinct($e.target.user.userid)
    $sensitive_group_hits = count_distinct($e.target.group.group_display_name)
    $risk_score = if($sensitive_group_hits >= 3, "Critical",
                   if($sensitive_group_hits >= 1, "High",
                   if($event_count >= 10, "Medium", "Low")))

  condition:
    $e
}

high severity high confidence

Data Sources

Windows Security Event Log via Chronicle forwarder or Google Cloud Pub/Sub Active Directory Domain Controller event logs UDM normalized Windows event data

Required Tables

WINEVTLOG UDM events Chronicle UDM entity graph (principal, target)

False Positives

Identity lifecycle management platforms (e.g., Microsoft Identity Manager, Okta AD agent) performing synchronized provisioning operations that touch sensitive group memberships as part of role-based access control workflows across many users simultaneously
Tiered administration models where Tier 0 admin accounts legitimately perform bulk account modifications on Domain Controllers — these will match on every policy enforcement run without indicating malicious activity
Vulnerability scanners or EDR agents running under privileged service accounts that enumerate group memberships, causing 4648 explicit credential logon events that correlate with account modification events from the same host

CrowdStrike LogScale (CQL)

cql

// T1098 Account Manipulation — Windows Security Events via CrowdStrike Falcon LogScale
// Requires Windows Security Event Log forwarding to LogScale

#event_simpleName = "UserAccountModified"
OR (#event_simpleName = "UserAccountCreated" AND TargetUserName != "")
OR (
  event.code in [4738, 4670, 4732, 4728, 4756, 4735, 4648]
  AND channel = "Security"
)
| SubjectUserName != ["-", "SYSTEM", "LOCAL SERVICE", "NETWORK SERVICE", "ANONYMOUS LOGON"]
| !regex(SubjectUserName, regex=`\$$`)
| changeType := case {
    event.code == 4738 => "UserAccountModified";
    event.code == 4670 => "PermissionsChanged";
    event.code == 4732 => "AddedToLocalGroup";
    event.code == 4728 => "AddedToGlobalGroup";
    event.code == 4756 => "AddedToUniversalGroup";
    event.code == 4735 => "LocalGroupModified";
    event.code == 4648 => "ExplicitCredentialLogon";
    #event_simpleName == "UserAccountModified" => "FalconUserAccountModified";
    * => "Unknown"
  }
| isSensitiveGroup := if(
    regex(TargetUserName, regex=`(?i)(domain admins|enterprise admins|schema admins|^administrators$|account operators|backup operators|server operators|group policy creator owners|remote management users|esx admins)`),
    1, 0
  )
| isHighRisk := if(isSensitiveGroup == 1 OR event.code == 4670, 1, 0)
| groupBy(
    [SubjectUserName, ComputerName],
    function=[
      count(as=TotalEvents),
      sum(isHighRisk, as=HighRiskCount),
      collect([changeType], as=ChangeTypes, limit=20),
      collect([TargetUserName], as=AffectedAccounts, limit=20),
      min(@timestamp, as=FirstSeen),
      max(@timestamp, as=LastSeen)
    ]
  )
| RiskScore := case {
    HighRiskCount >= 3 => "Critical";
    HighRiskCount >= 1 => "High";
    TotalEvents >= 10 => "Medium";
    * => "Low"
  }
| sort(HighRiskCount, TotalEvents, order=desc)

high severity high confidence

Data Sources

CrowdStrike Falcon platform native telemetry (UserAccountModified, UserAccountCreated) Windows Security Event Log forwarded to LogScale via Falcon Log Collector or Winlogbeat Active Directory Domain Controller Falcon sensor telemetry

Required Tables

Falcon #event_simpleName = UserAccountModified Falcon #event_simpleName = UserAccountCreated Windows Security channel events (event.code 4738/4670/4732/4728/4756/4735/4648)

False Positives

CrowdStrike Falcon Spotlight or Identity Protection module performing automated account risk assessments, which can generate UserAccountModified telemetry for accounts flagged during posture evaluation scans across the fleet
Enterprise PAM solutions (e.g., BeyondTrust, CyberArk) checking out privileged credentials and performing just-in-time group membership elevation — these generate clusters of sensitive group addition events from a service account that self-resolve after the checkout window expires
Microsoft Entra ID (Azure AD) Connect sync agents reconciling on-premises AD group memberships with cloud identities, producing repeated 4728/4756 events from the MSOL sync service account whenever a cloud-side role assignment changes are written back to on-prem AD

Last updated: 2026-04-13 Research depth: deep

References (10)

Response Playbook

1. Examine the full command line and decode any Base64 content...
2. Identify the parent process chain and user context...
3. Check for concurrent network connections from the process...

Investigation Guide

Related techniques: T1027, T1105, T1562.001...
Forensic artifacts: PSReadLine history, Prefetch, ScriptBlock logs...

Atomic Red Team Tests

Test 1: Encoded command execution...
Test 2: Download cradle via Net.WebClient...

Unlock Pro Content

Get the full detection package for T1098 including response playbook, investigation guide, and atomic red team tests.

Response PlaybookInvestigation GuideHunting QueriesAtomic Red Team TestsTuning Guidance

Account Manipulation

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Sub-techniques (7)

Same Tactic: Persistence

Popular Detections