T1098

Account Manipulation

Persistence Privilege Escalation Last updated:

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. Account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

What is T1098 Account Manipulation?

Account Manipulation (T1098) maps to the Persistence and Privilege Escalation tactics — the adversary is trying to maintain their foothold in MITRE ATT&CK.

This page provides production-ready detection logic for Account Manipulation, covering the data sources and telemetry it touches: User Account: User Account Modification, Active Directory: Active Directory Object Modification, Windows Security Event Log. The queries below are rated high severity at high confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Persistence Privilege Escalation
Technique
T1098 Account Manipulation
Canonical reference
https://attack.mitre.org/techniques/T1098/
Microsoft Sentinel / Defender
kusto 
// T1098 — Account Manipulation: Detects suspicious account property changes, privilege assignments, and group membership modifications
let SensitiveGroups = dynamic(["Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators", "Account Operators", "Backup Operators", "Print Operators", "Server Operators", "Group Policy Creator Owners", "Remote Management Users", "ESX Admins"]);
let LookbackWindow = 1d;
union
(
    // 4738 - User account changed (password reset, UserAccountControl changes, etc.)
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4738
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "UserAccountModified"
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4670 - Account permissions changed
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4670
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "PermissionsChanged"
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4732 - Member added to security-enabled local group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4732
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4728 - Member added to security-enabled global group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4728
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToGlobalGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4756 - Member added to security-enabled universal group
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4756
    | extend TargetAccount = MemberName, ChangedBy = SubjectUserName
    | extend GroupName = TargetUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = strcat("AddedToUniversalGroup:", GroupName)
    | where GroupName in~ (SensitiveGroups)
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
),
(
    // 4648 - Logon using explicit credentials after account change (potential Skeleton Key)
    SecurityEvent
    | where TimeGenerated > ago(LookbackWindow)
    | where EventID == 4648
    | extend TargetAccount = TargetUserName, ChangedBy = SubjectUserName
    | extend AccountDomain = TargetDomainName
    | extend ChangeType = "ExplicitCredentialLogon"
    | where SubjectUserName != TargetUserName
    | project TimeGenerated, EventID, TargetAccount, ChangedBy, AccountDomain, ChangeType, Computer, _SubscriptionId
)
| summarize EventCount=count(), EventTypes=make_set(ChangeType), AffectedAccounts=make_set(TargetAccount), FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by ChangedBy, Computer
| where EventCount >= 1
| extend RiskScore = case(
    EventCount >= 10, "High",
    EventCount >= 3, "Medium",
    "Low"
  )
| sort by EventCount desc

Detects account manipulation activity across Windows domain environments using Security event log data. Monitors for user account property changes (EventID 4738), permission modifications (EventID 4670), and membership additions to sensitive groups including Domain Admins, Enterprise Admins, Administrators, and ESX Admins (EventIDs 4732, 4728, 4756). Also captures explicit credential logon events (EventID 4648) that may indicate Skeleton Key or pass-the-hash activity following account compromise. Results are aggregated by actor and computer with a risk score based on activity volume.

high severity high confidence

Data Sources

User Account: User Account Modification Active Directory: Active Directory Object Modification Windows Security Event Log

Required Tables

SecurityEvent

False Positives

  • IT administrators performing legitimate account provisioning or group membership changes during onboarding or role transitions
  • Automated identity management systems (SailPoint, Saviynt, AD Connect) performing scheduled sync operations that generate bulk account modification events
  • Help desk staff performing password resets or account unlock operations which generate 4738 events
  • Group Policy or SCCM deployments that modify local group membership across endpoints as part of standard configuration management
  • Scheduled account maintenance scripts that iterate through stale accounts and modify their properties

Sigma rule & cross-platform mapping

The detection logic for Account Manipulation (T1098) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1098 Sigma rules on detection.fyi

Platform-specific guides for T1098

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (9)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Add User to Local Administrators Group

    Expected signal: Security Event ID 4732: A member was added to a security-enabled local group. SubjectUserName = actor, TargetUserName = Administrators (group), MemberName = df00tech-testuser. Sysmon Event ID 1 if executed via cmd.exe: Process Create with Image=net.exe, CommandLine='net localgroup Administrators df00tech-testuser /add'.

  2. Test 2Modify User Account Password — Simulate Credential Manipulation

    Expected signal: Security Event ID 4738: A user account was changed. SubjectUserName = executing account, TargetUserName = df00tech-testuser. The 'Changed Attributes' section will show 'Password Last Set' updated. Sysmon Event ID 1: Process Create with net.exe command line visible.

  3. Test 3Disable Password Expiry on Account (UserAccountControl Manipulation)

    Expected signal: Security Event ID 4738: A user account was changed. The event detail will show UserAccountControl change with the new value including the DONT_EXPIRE_PASSWORD flag (0x10000 bit set). SubjectUserName identifies the actor performing the change.

  4. Test 4Rename Administrator Account (Lazarus Group TTPs)

    Expected signal: Security Event ID 4738: A user account was changed. TargetUserName will show the new account name, and 'SAM Account Name' in the changed attributes will reflect the rename. Sysmon Event ID 1: Process Create with wmic.exe and the rename command visible in CommandLine.

  5. Test 5Grant Remote Desktop Access via Group Membership

    Expected signal: Security Event ID 4732: A member was added to a security-enabled local group. TargetUserName = Remote Desktop Users, MemberName = df00tech-testuser, SubjectUserName = executing account. Sysmon Event ID 1: Process Create for powershell.exe with Add-LocalGroupMember in CommandLine.

Response Playbook

Triage

  1. Identify the actor account that performed the modification — is this a known admin, service account, or a standard user account? Standard users should never be modifying privileged group memberships or account permissions.
  2. Determine the target account and what specifically was changed — was this a group membership addition to a sensitive group (Domain Admins, Enterprise Admins), a password hash change, or a UserAccountControl flag modification (e.g., disabling password expiry, enabling delegation)?
  3. Check Event ID 4738 details: examine which specific user attributes changed by reviewing the 'Changed Attributes' section. Fields like 'Password Last Set', 'Account Expires', 'User Account Control' changes are particularly suspicious.
  4. Correlate with logon events — did the actor authenticate interactively or via network logon (Event ID 4624) in the same session? What was the logon type and source IP?
  5. Verify whether there is a corresponding change management ticket or approval record for this modification — unticketted changes to privileged groups are high-priority alerts.
  6. Check if the actor account itself was recently created or had its own permissions elevated prior to making these changes — this is a common adversary pattern (compromise account → elevate → manipulate other accounts).
  7. Review the computer where the event originated — domain controller events are expected for AD changes, but group membership events on member servers or workstations indicate local group manipulation which is equally suspicious.

Containment

  1. If unauthorized group membership addition detected: immediately remove the added account from the sensitive group using Active Directory Users and Computers or: Remove-ADGroupMember -Identity 'Domain Admins' -Members <username> -Confirm:$false
  2. If the actor account appears compromised: disable the account immediately in Active Directory: Disable-ADAccount -Identity <username>, and force a password reset for all accounts modified by that actor.
  3. Revoke all active sessions and Kerberos tickets for affected accounts: run 'klist purge' on the compromised host and use the Microsoft tool 'Invoke-ADFSTTiCket' or reset the account password to invalidate existing TGTs.
  4. If Skeleton Key or Mimikatz-style manipulation is suspected: immediately restart the affected domain controller's LSASS process (requires DC reboot), or reimage the DC if persistence artifacts are found.
  5. Block lateral movement: if attacker used newly-elevated privileges to access other systems, review authentication logs for accounts that logged on with the modified account's credentials and isolate those endpoints.
  6. For ESXi/vSphere environments: if unauthorized ESX Admins group membership detected, review vCenter audit logs, revoke vCenter SSO tokens, and audit all recent VM operations performed by the added account.

Evidence Collection

  1. Windows Security Event Log — Event ID 4738 (user account changed): capture the full event including Changed Attributes section which lists exactly which properties were modified
  2. Windows Security Event Log — Event ID 4732/4728/4756 (group membership additions): document the MemberName, TargetUserName (group), and SubjectUserName (actor)
  3. Windows Security Event Log — Event ID 4670 (permissions changed): includes old and new security descriptors for comparison
  4. Windows Security Event Log — Event ID 4624/4648 preceding the modification: establishes how the actor authenticated and from which source IP
  5. Active Directory replication metadata: run 'repadmin /showobjmeta <DC> <user DN>' to see when and from which DC each attribute was last modified
  6. PowerShell: Get-ADUser <username> -Properties * | Select PasswordLastSet, LastLogonDate, MemberOf, UserAccountControl — captures current account state
  7. PowerShell: Get-ADGroupMember -Identity 'Domain Admins' | Select Name, SamAccountName, DistinguishedName — documents current sensitive group membership
  8. LSASS memory dump (if Skeleton Key suspected): use Task Manager or ProcDump to capture LSASS memory for offline analysis — note this requires careful handling per incident response procedures
  9. Network forensics: capture and review LDAP traffic to/from the domain controller during the manipulation window — tools like Wireshark with LDAP filter can reveal the modification request source

Escalation Criteria

  • ! Any addition to Domain Admins, Enterprise Admins, Schema Admins, or ESX Admins — these are highest-privilege groups and any unauthorized addition constitutes a critical security incident
  • ! Account manipulation performed by a non-admin account or a service account — this indicates the service account or user account has been compromised and used for privilege escalation
  • ! Bulk modifications: more than 3 account manipulations within a 15-minute window from a single actor — indicates automated attack tooling or scripted manipulation
  • ! Account manipulation followed by immediate logon events from new IP addresses or unusual geographies — indicates the modified account is being actively exploited
  • ! Evidence of Mimikatz or similar tools in process creation events on the same host as the domain controller handling the modification — SetNTLM and ChangeNTLM commands are specific Mimikatz indicators
  • ! UserAccountControl modifications disabling 'Password Required' or enabling 'Password Never Expires' on high-privilege accounts — persistence mechanism for maintaining long-term access
  • ! Account modifications on a domain controller performed outside business hours or from a non-admin workstation source IP

Investigation Guide

Forensic Artifacts

  • > Windows Security Event Log on Domain Controllers: Event IDs 4728, 4732, 4738, 4756, 4670, 4648 — primary evidence source for AD account manipulation
  • > Active Directory attribute replication metadata: 'repadmin /showobjmeta <DC FQDN> "<user DN>"' shows per-attribute change timestamps and originating DC
  • > Active Directory tombstone objects (if account was deleted and recreated): recoverable from AD Recycle Bin or authoritative restore
  • > NTDS.dit database: contains complete AD account data including password hashes, group memberships, and attribute history — requires Volume Shadow Copy or offline extraction
  • > Registry: HKLM\SAM\SAM\Domains\Account\Users — local SAM database on member servers; changes here reflect local account manipulation
  • > Event Log: Microsoft-Windows-Directory-Service/Analytic — verbose DS operations including attribute-level changes
  • > Sysmon Event ID 10 (ProcessAccess) targeting LSASS: indicates credential dumping preceding account manipulation
  • > Network captures: LDAP modify operations (opcode 6) in Wireshark against port 389/636 to domain controllers
  • > PowerShell history: %APPDATA%\Microsoft\Windows\PowerShell\PSReadLine\ConsoleHost_history.txt on actor's workstation may contain manipulation commands
  • > VSS Shadow Copies on domain controllers: may contain NTDS.dit snapshots showing pre-attack account state for comparison

Tuning Guidance

Start by inventorying legitimate privileged group management processes in your environment. Key questions: which service accounts perform AD provisioning (AD Connect, SailPoint, etc.)? What is the expected volume of 4738 events from help desk operations? Build an allowlist of known-good SubjectUserName values for each modification type, but scope allowlisting narrowly — never exclude patterns wholesale, only specific actor+target combinations with documented change management backing. For sensitive group additions (Domain Admins, Enterprise Admins), consider a zero-tolerance policy — any addition should generate an alert regardless of the actor, since even legitimate changes should be rare and ticketed. The bulk modification hunting query threshold of 5 modifications per 15 minutes may need tuning upward in environments with active identity lifecycle management, but should remain below 20. For the UserAccountControl hunting query, the PasswordNeverExpires flag generates high false positive volume in environments where service accounts have this flag set by design — build a static allowlist of known service account SAMAccountNames rather than tuning it out entirely. In Azure AD / Entra ID environments, supplement Windows Security events with AuditLogs (operationName contains 'Update user' or 'Add member to role') and AADSignInLogs for post-manipulation logon correlation.

Hunting Queries

Hunt for privileged group membership additions followed by logon events within 4 hours. This pattern — add account to Domain Admins, then immediately log in — is a strong indicator of adversarial privilege escalation and immediate exploitation of newly-granted access.

Hunting — KQL
kql 
// Hunt for accounts added to sensitive groups with temporal correlation to subsequent logon events
let SensitiveGroups = dynamic(["Domain Admins", "Enterprise Admins", "Schema Admins", "Administrators", "ESX Admins"]);
let GroupAdditions = SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID in (4732, 4728, 4756)
    | where TargetUserName has_any (SensitiveGroups)
    | project AddTime=TimeGenerated, AddedAccount=MemberName, GroupName=TargetUserName, AddedBy=SubjectUserName;
let SubsequentLogons = SecurityEvent
    | where TimeGenerated > ago(7d)
    | where EventID == 4624
    | where LogonType in (2, 3, 10)
    | project LogonTime=TimeGenerated, LogonAccount=TargetUserName, LogonSource=IpAddress, LogonType;
GroupAdditions
| join kind=inner (SubsequentLogons) on $left.AddedAccount == $right.LogonAccount
| where LogonTime > AddTime and LogonTime < datetime_add('hour', 4, AddTime)
| project AddTime, AddedAccount, GroupName, AddedBy, LogonTime, LogonSource, LogonType
| sort by AddTime desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4732 OR EventCode=4728 OR EventCode=4756)
| eval GroupName=coalesce(TargetUserName, Target_Group_Name)
| where match(lower(GroupName), "domain admins|enterprise admins|schema admins|administrators|esx admins")
| eval AddedAccount=coalesce(MemberName, Member_Account_Name)
| eval AddedBy=coalesce(SubjectUserName, Subject_Account_Name)
| eval AddTime=_time
| join type=inner max=5 AddedAccount [
    search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4624 (LogonType=2 OR LogonType=3 OR LogonType=10)
    | eval AddedAccount=coalesce(TargetUserName, Target_Account_Name)
    | eval LogonTime=_time
    | eval LogonSource=IpAddress
    | table AddedAccount, LogonTime, LogonSource
  ]
| where LogonTime > AddTime AND LogonTime < AddTime + 14400
| table AddTime, AddedAccount, GroupName, AddedBy, LogonTime, LogonSource
| sort - AddTime

Hunt for actors performing bulk account modifications in 15-minute windows — 5+ modifications or 3+ unique target accounts. This pattern indicates automated attack tooling (Mimikatz scripts, BloodHound-assisted attacks, or post-exploitation frameworks) rather than manual administrator actions.

Hunting — KQL
kql 
// Hunt for rapid successive account modifications by the same actor (bulk manipulation pattern)
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID in (4738, 4670, 4732, 4728, 4756, 4735)
| extend Actor = SubjectUserName
| extend Target = coalesce(TargetUserName, MemberName)
| where Actor != "-" and Actor !endswith "$"
| summarize ModCount=count(), UniqueTargets=dcount(Target), ModTypes=make_set(EventID), FirstMod=min(TimeGenerated), LastMod=max(TimeGenerated) by Actor, bin(TimeGenerated, 15m)
| where ModCount >= 5 or UniqueTargets >= 3
| extend BurstDurationMin = datetime_diff('minute', LastMod, FirstMod)
| sort by ModCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" (EventCode=4738 OR EventCode=4670 OR EventCode=4732 OR EventCode=4728 OR EventCode=4756 OR EventCode=4735)
| eval Actor=coalesce(SubjectUserName, Subject_Account_Name)
| eval Target=coalesce(TargetUserName, Target_Account_Name, MemberName)
| where Actor!="-" AND NOT match(Actor, "\$$")
| bucket _time span=15m
| stats count as ModCount, dc(Target) as UniqueTargets, values(EventCode) as ModTypes, earliest(_time) as FirstMod, latest(_time) as LastMod by Actor, _time
| where ModCount >= 5 OR UniqueTargets >= 3
| eval BurstDurationMin=round((LastMod - FirstMod) / 60, 1)
| sort - ModCount

Hunt for UserAccountControl flag changes that weaken account security: disabling password requirements, enabling password-never-expires, or disabling Kerberos pre-authentication. These modifications are commonly used by adversaries to create durable backdoor accounts or to enable AS-REP roasting attacks against manipulated accounts.

Hunting — KQL
kql 
// Hunt for UserAccountControl flag changes that weaken account security
SecurityEvent
| where TimeGenerated > ago(7d)
| where EventID == 4738
| extend OldUAC = toint(extract(@"Old UAC Value:\s+0x([0-9A-Fa-f]+)", 1, EventData))
| extend NewUAC = toint(extract(@"New UAC Value:\s+0x([0-9A-Fa-f]+)", 1, EventData))
| extend PasswordNotRequired = (NewUAC & 32) != 0  // 0x20 = PASSWD_NOTREQD
| extend PasswordNeverExpires = (NewUAC & 65536) != 0  // 0x10000 = DONT_EXPIRE_PASSWORD
| extend AccountNotDelegatable = (NewUAC & 1048576) != 0  // 0x100000 = NOT_DELEGATED removed = delegation enabled
| extend KerberosPreAuthDisabled = (NewUAC & 4194304) != 0  // 0x400000 = DONT_REQ_PREAUTH
| where PasswordNotRequired or PasswordNeverExpires or KerberosPreAuthDisabled
| project TimeGenerated, Computer, TargetUserName, SubjectUserName, PasswordNotRequired, PasswordNeverExpires, KerberosPreAuthDisabled, NewUAC
| sort by TimeGenerated desc
Hunting — SPL
spl 
index=wineventlog sourcetype="WinEventLog:Security" EventCode=4738
| rex field=_raw "New UAC Value:\s+0x(?<NewUAC_Hex>[0-9A-Fa-f]+)"
| eval NewUAC=tonumber("0x" + NewUAC_Hex, 16)
| eval PasswordNotRequired=if(mvfind(split(tostring(band(NewUAC, 32)), "0"), "0") < 0, 1, 0)
| eval PasswordNeverExpires=if(band(NewUAC, 65536) > 0, 1, 0)
| eval KerberosPreAuthDisabled=if(band(NewUAC, 4194304) > 0, 1, 0)
| where PasswordNotRequired=1 OR PasswordNeverExpires=1 OR KerberosPreAuthDisabled=1
| eval Actor=coalesce(SubjectUserName, Subject_Account_Name)
| eval Target=coalesce(TargetUserName, Target_Account_Name)
| table _time, host, Target, Actor, PasswordNotRequired, PasswordNeverExpires, KerberosPreAuthDisabled, NewUAC_Hex
| sort - _time

Atomic Red Team Tests

Test 1 Add User to Local Administrators Group
windows

Adds a standard domain or local user to the local Administrators group — a common first step in privilege escalation following account compromise. This simulates attackers like Lazarus Group and Scattered Spider who add accounts to privileged groups to establish persistent elevated access.

Command

powershell 
net localgroup Administrators df00tech-testuser /add

Cleanup

powershell 
net localgroup Administrators df00tech-testuser /delete

Expected Telemetry

Security Event ID 4732: A member was added to a security-enabled local group. SubjectUserName = actor, TargetUserName = Administrators (group), MemberName = df00tech-testuser. Sysmon Event ID 1 if executed via cmd.exe: Process Create with Image=net.exe, CommandLine='net localgroup Administrators df00tech-testuser /add'.

Expected Detection

Alert fires on EventID 4732 with TargetUserName matching 'Administrators'. KQL: EventID == 4732 and TargetUserName == 'Administrators'. SPL: EventCode=4732 where GroupName matches 'administrators'. Risk score elevated for sensitive group match.

Test 2 Modify User Account Password — Simulate Credential Manipulation
windows

Resets another user account's password using net user — simulates adversary credential manipulation to maintain access to a compromised account. This generates Event ID 4738 (user account changed) and is consistent with HAFNIUM's documented technique of resetting default admin account passwords.

Command

powershell 
net user df00tech-testuser Argus@Testing2026! /domain

Expected Telemetry

Security Event ID 4738: A user account was changed. SubjectUserName = executing account, TargetUserName = df00tech-testuser. The 'Changed Attributes' section will show 'Password Last Set' updated. Sysmon Event ID 1: Process Create with net.exe command line visible.

Expected Detection

Alert fires on EventID 4738 from non-admin actor. KQL: EventID == 4738 with ChangeType='UserAccountModified'. SPL: EventCode=4738 aggregated under actor with TotalEvents count increment.

Test 3 Disable Password Expiry on Account (UserAccountControl Manipulation)
windows

Modifies a user account's UserAccountControl flag to set DONT_EXPIRE_PASSWORD — a persistence technique used to preserve access to compromised accounts indefinitely. This bypasses password rotation policies that would otherwise invalidate the adversary's access.

Command

powershell 
Set-ADUser -Identity df00tech-testuser -PasswordNeverExpires $true

Cleanup

powershell 
Set-ADUser -Identity df00tech-testuser -PasswordNeverExpires $false

Expected Telemetry

Security Event ID 4738: A user account was changed. The event detail will show UserAccountControl change with the new value including the DONT_EXPIRE_PASSWORD flag (0x10000 bit set). SubjectUserName identifies the actor performing the change.

Expected Detection

Alert fires on EventID 4738 where NewUAC value has bit 0x10000 (65536) set. KQL: PasswordNeverExpires=true in UAC hunting query. SPL: KerberosPreAuthDisabled or PasswordNeverExpires eval flags triggered.

Test 4 Rename Administrator Account (Lazarus Group TTPs)
windows

Renames the built-in local Administrator account — a technique observed in Lazarus Group malware (WhiskeyDelta-Two) to evade detection tools looking for the default account name, while preserving the SID-based privileges of the Administrator account.

Command

powershell 
wmic useraccount where "name='Administrator'" rename 'df00tech-backdoor'

Cleanup

powershell 
wmic useraccount where "name='df00tech-backdoor'" rename 'Administrator'

Expected Telemetry

Security Event ID 4738: A user account was changed. TargetUserName will show the new account name, and 'SAM Account Name' in the changed attributes will reflect the rename. Sysmon Event ID 1: Process Create with wmic.exe and the rename command visible in CommandLine.

Expected Detection

Alert fires on EventID 4738 where SAM Account Name attribute changed. The KQL query captures 4738 events; analysts should filter for attribute changes to SAM Account Name. Sysmon detection via wmic.exe spawning with 'useraccount' and 'rename' in command line.

Test 5 Grant Remote Desktop Access via Group Membership
windows

Adds a user to the Remote Desktop Users group — a lateral movement enablement technique used by adversaries to gain persistent remote access to compromised hosts without requiring local admin privileges. Commonly used after initial compromise to establish a secondary access path.

Command

powershell 
Add-LocalGroupMember -Group 'Remote Desktop Users' -Member df00tech-testuser

Cleanup

powershell 
Remove-LocalGroupMember -Group 'Remote Desktop Users' -Member df00tech-testuser

Expected Telemetry

Security Event ID 4732: A member was added to a security-enabled local group. TargetUserName = Remote Desktop Users, MemberName = df00tech-testuser, SubjectUserName = executing account. Sysmon Event ID 1: Process Create for powershell.exe with Add-LocalGroupMember in CommandLine.

Expected Detection

Alert fires on EventID 4732 with TargetUserName matching 'Remote Desktop Users'. If 'Remote Desktop Users' is in the sensitive groups list, risk score elevated. SPL: EventCode=4732 with group name match.

Related Detections

Tactic Hubs

TA0003PersistenceTA0004Privilege Escalation

Sub-techniques (7)

Related Techniques

T1078Valid AccountsT1078.002Domain AccountsT1003OS Credential DumpingT1003.001LSASS MemoryT1550.002Pass the HashT1558Steal or Forge Kerberos TicketsT1136Create AccountT1098.001Additional Cloud CredentialsT1098.003Additional Cloud RolesT1098.007Additional Local or Domain GroupsT1484Domain or Tenant Policy ModificationT1069Permission Groups Discovery

Same Tactic: Persistence

Popular Detections