Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.[1] These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.
In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.
| 效应类型 | 是否存在 |
|---|---|
| 特征伪装 | ✅ |
| 行为透明 | ✅ |
| 数据遮蔽 | ✅ |
| 时空释痕 | ✅ |
攻击者通过伪造安全令牌数字签名、模拟服务账户行为特征，使恶意权限变更操作在协议层和日志层呈现为合法管理行为。例如影子令牌生成技术利用标准协议字段构造具备合法签名的访问凭证，使得令牌验证系统无法区分恶意变造特征。
通过劫持系统服务进程（如服务账户寄生）或利用底层协议漏洞（如权限克隆），攻击者使权限变更操作绕过常规审计通道，在防御方视角下表现为未发生实质性权限变更的"透明"状态。
在凭证增量更新等场景中，攻击者利用加密存储的密码哈希和TLS加密通道，遮蔽密码修改的恶意意图。部分技术还将篡改后的权限配置进行二进制混淆，阻碍基于日志解析的异常检测。
通过将单次高危操作分解为长周期、低频率的分散变更（如分阶段权限注入），攻击者使单个操作事件的特征浓度低于检测阈值，同时利用服务账户的定期任务执行特性，将恶意行为稀释在正常运维操作的时间流中。
| ID | Name | Description |
|---|---|---|
| C0025 | 2016 Ukraine Electric Power Attack |
During the 2016 Ukraine Electric Power Attack, Sandworm Team used the |
| S0274 | Calisto | |
| G0125 | HAFNIUM | |
| G0032 | Lazarus Group |
Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.[5][6] |
| S0002 | Mimikatz |
The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The |
| ID | Mitigation | Description |
|---|---|---|
| M1042 | Disable or Remove Feature or Program |
Remove unnecessary and potentially abusable authentication and authorization mechanisms where possible. |
| M1032 | Multi-factor Authentication |
Use multi-factor authentication for user and privileged accounts. |
| M1030 | Network Segmentation |
Configure access controls and firewalls to limit access to critical systems and domain controllers. Most cloud environments support separate virtual private cloud (VPC) instances that enable further segmentation of cloud systems. |
| M1028 | Operating System Configuration |
Protect domain controllers by ensuring proper security configuration for critical servers to limit access by potentially unnecessary protocols and services, such as SMB file sharing. |
| M1026 | Privileged Account Management |
Do not allow domain administrator accounts to be used for day-to-day operations that may expose them to potential adversaries on unprivileged systems. |
| M1022 | Restrict File and Directory Permissions |
Restrict access to potentially sensitive files that deal with authentication and/or authorization. |
| M1018 | User Account Management |
Ensure that low-privileged user accounts do not have permissions to modify accounts or account-related policies. |
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0026 | Active Directory | Active Directory Object Modification |
Monitor for the registration or joining of new device objects in Active Directory. Raise alerts when new devices are registered or joined without using MFA.[9] |
| DS0017 | Command | Command Execution |
Monitor executed commands and arguments for suspicious commands to modify accounts or account settings (including files such as the Monitor executed commands and arguments of suspicious commands (such as |
| DS0022 | File | File Modification |
Monitor for changes made to files related to account settings, such as |
| DS0036 | Group | Group Modification |
Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670. |
| DS0009 | Process | Process Creation |
Monitor for newly constructed processes indicative of modifying account settings, such as those that modify |
| DS0002 | User Account | User Account Modification |
Monitor events for changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670. Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ or that include additional flags such as changing a password without knowledge of the old password. Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts. |