Detect Account Manipulation in Sumo Logic CSE
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. Account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
MITRE ATT&CK
- Tactic
- Persistence Privilege Escalation
- Technique
- T1098 Account Manipulation
- Canonical reference
- https://attack.mitre.org/techniques/T1098/
Sumo Detection Query
_sourceCategory=Windows/Security ("EventCode=4738" OR "EventCode=4670" OR "EventCode=4732" OR "EventCode=4728" OR "EventCode=4756" OR "EventCode=4735" OR "EventCode=4648")
| parse "EventCode=*" as EventCode
| parse "SubjectUserName=*" as ActorAccount nodrop
| parse "TargetUserName=*" as TargetAccount nodrop
| parse "TargetDomainName=*" as TargetDomain nodrop
| parse "MemberName=%CN=*," as MemberCN nodrop
| parse "Computer=*" as SourceHost nodrop
| where !(ActorAccount matches "-" or ActorAccount matches "SYSTEM" or ActorAccount matches "LOCAL SERVICE" or ActorAccount matches "NETWORK SERVICE")
| eval ChangeType = if(EventCode == "4738", "UserAccountModified",
if(EventCode == "4670", "PermissionsChanged",
if(EventCode == "4732", "AddedToLocalGroup",
if(EventCode == "4728", "AddedToGlobalGroup",
if(EventCode == "4756", "AddedToUniversalGroup",
if(EventCode == "4735", "LocalGroupModified",
if(EventCode == "4648", "ExplicitCredentialLogon", "Unknown")))))))
| eval IsSensitiveGroup = if(
matches(toLowerCase(TargetAccount), ".*domain admins.*") or
matches(toLowerCase(TargetAccount), ".*enterprise admins.*") or
matches(toLowerCase(TargetAccount), ".*schema admins.*") or
matches(toLowerCase(TargetAccount), ".*administrators.*") or
matches(toLowerCase(TargetAccount), ".*account operators.*") or
matches(toLowerCase(TargetAccount), ".*backup operators.*") or
matches(toLowerCase(TargetAccount), ".*server operators.*") or
matches(toLowerCase(TargetAccount), ".*group policy creator owners.*") or
matches(toLowerCase(TargetAccount), ".*remote management users.*") or
matches(toLowerCase(TargetAccount), ".*esx admins.*"), 1, 0)
| eval IsHighRisk = if(IsSensitiveGroup == 1 OR EventCode == "4670", 1, 0)
| stats count as TotalEvents,
sum(IsHighRisk) as HighRiskCount,
values(ChangeType) as ChangeTypes,
values(TargetAccount) as AffectedAccounts,
min(_messageTime) as FirstSeen,
max(_messageTime) as LastSeen
by ActorAccount, SourceHost
| eval RiskScore = if(HighRiskCount >= 3, "Critical",
if(HighRiskCount >= 1, "High",
if(TotalEvents >= 10, "Medium", "Low")))
| where TotalEvents >= 1
| sort by HighRiskCount, TotalEventsDetects T1098 Account Manipulation in Sumo Logic by parsing Windows Security Event Log messages for Event IDs 4738, 4670, 4732, 4728, 4756, 4735, and 4648. Uses field parsing from raw Windows event log messages to extract actor, target, and group context. Computes a risk score based on sensitive group involvement and permission changes, aggregating by actor account and source host to surface the most suspicious actors.
Data Sources
Required Tables
False Positives & Tuning
- Privileged Access Workstation (PAW) administrators performing legitimate just-in-time (JIT) access assignments that temporarily add accounts to sensitive groups like Domain Admins, which generates 4728/4732/4756 events followed by rapid removal events
- IT operations teams running automated compliance scripts that audit and correct group memberships — these produce clusters of account modification events from a single service account across many targets in a short window
- SCCM/MECM or Intune enrollment processes that modify local Administrators group membership on endpoints, generating high volumes of 4732 events from domain controller service accounts
Other platforms for T1098
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Add User to Local Administrators Group
Expected signal: Security Event ID 4732: A member was added to a security-enabled local group. SubjectUserName = actor, TargetUserName = Administrators (group), MemberName = df00tech-testuser. Sysmon Event ID 1 if executed via cmd.exe: Process Create with Image=net.exe, CommandLine='net localgroup Administrators df00tech-testuser /add'.
- Test 2Modify User Account Password — Simulate Credential Manipulation
Expected signal: Security Event ID 4738: A user account was changed. SubjectUserName = executing account, TargetUserName = df00tech-testuser. The 'Changed Attributes' section will show 'Password Last Set' updated. Sysmon Event ID 1: Process Create with net.exe command line visible.
- Test 3Disable Password Expiry on Account (UserAccountControl Manipulation)
Expected signal: Security Event ID 4738: A user account was changed. The event detail will show UserAccountControl change with the new value including the DONT_EXPIRE_PASSWORD flag (0x10000 bit set). SubjectUserName identifies the actor performing the change.
- Test 4Rename Administrator Account (Lazarus Group TTPs)
Expected signal: Security Event ID 4738: A user account was changed. TargetUserName will show the new account name, and 'SAM Account Name' in the changed attributes will reflect the rename. Sysmon Event ID 1: Process Create with wmic.exe and the rename command visible in CommandLine.
- Test 5Grant Remote Desktop Access via Group Membership
Expected signal: Security Event ID 4732: A member was added to a security-enabled local group. TargetUserName = Remote Desktop Users, MemberName = df00tech-testuser, SubjectUserName = executing account. Sysmon Event ID 1: Process Create for powershell.exe with Add-LocalGroupMember in CommandLine.
References (10)
- https://attack.mitre.org/techniques/T1098/
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4738
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670
- https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4732
- https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738
- https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM
- https://github.com/gentilkiwi/mimikatz/issues/92
- https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html
- https://www.volexity.com/blog/2021/03/01/the-mass-exploitation-of-on-premises-exchange-servers/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1098/T1098.md
Unlock Pro Content
Get the full detection package for T1098 including response playbook, investigation guide, and atomic red team tests.