Account Manipulation
Process Modify UserAccount — Modify properties of an existing user account to maintain access or escalate privilege.
Detect
The actor.user.name + user.name + activity_id triple is technique-defining and platform-agnostic. Detecting unexpected account modifications (MFA factor additions, group membership changes outside change windows) is STP 5 regardless of IdP.
Generate EDE-specific sub-techniques per identity platform (T1098.entra, T1098.okta, T1098.aws-iam). Prioritise detecting MFA manipulation and privilege group membership changes.
Mitigate
MFA and break-glass approval workflows raise the cost of account modification across all identity platforms but do not prevent the technique for an attacker who already holds an authenticated privileged session.
No STP 5 mitigation exists. Detection is the primary defensive lever.
Enforce Privileged Identity Management (PIM) or equivalent just-in-time access controls for account modification rights across all identity platforms.
Respond
An existing artifact was changed and remains in use in its altered state. Revert or restore from backup. Investigate all actions taken using the modified permissions or configuration.
actor.processactor.userd3f:ProcessTerminationd3f:AccountLockingd3f:CredentialRevokingd3f:NetworkIsolationOCSF event model▼
Event class: Account Change Activity (3001)
· activity_id: Update
%%{init: {"theme": "dark", "themeVariables": {"edgeLabelBackground": "#18181b", "lineColor": "#52525b"}}}%%
graph TD
classDef attacker fill:#7c2d12,stroke:#ea580c,color:#fed7aa
classDef victim fill:#1e3a5f,stroke:#3b82f6,color:#bfdbfe
classDef postSuccess fill:#78350f,stroke:#d97706,color:#fde68a
classDef tainted fill:#18181b,stroke:#52525b,color:#a1a1aa
EVENT(["Account Change Activity\n· Update"])
actor_process["Modifying Process\nactor.process\nd3f:Process"]:::attacker
actor_user["Admin Account\nactor.user\nd3f:UserAccount"]:::attacker
target_account["Target Account\nuser\nd3f:UserAccount"]:::victim
device["Host\ndevice\nd3f:Host\n⚠ tainted"]:::tainted
EVENT --> actor_process
actor_process --> actor_user
EVENT --> target_account
EVENT --> device
actor_process -.->|"modifies"| target_accountactor.process·d3f:Processactor.process.file.path | attacker_controlled | Tool or client performing the change — Execution Medium, attacker-chosen |
d3f:ProcessTerminationactor.user·d3f:UserAccountactor.user.name | attacker_controlled | Compromised admin account used — attacker-chosen from available credentials |
d3f:AccountLockingd3f:CredentialRevokinguser·d3f:UserAccountuser.name | variable | Account being modified — victim-side, value varies |
d3f:AccountLockingdevice·d3f:Hostd3f:NetworkIsolationDefinitional Sigma rule▼
Broad by design — defines the technique, not an operational alert. Gate on variable or attacker-controlled field conditions to narrow for production use.
title: Account Manipulation (T1098)
status: experimental
description: >
Definitional rule — broad by design. Defines the technique independent of
medium, tool, or attacker-controlled variables. Narrow with variable and
attacker-controlled field conditions for operational use.
logsource:
product: ocsf
category: Account Change Activity (3001)
detection:
selection:
activity_id: 'Update'
condition: selectionEnvironment-dependent entities▼
Generate org-specific sub-techniques using
T1098.<platform>
On-premises identity and directory services
Cloud-hosted identity and access management platforms
Native IAM systems for cloud platforms
Application-local user management
Seen in the wild1report▼
OAuth device code flow grants the attacker's registered application persistent M365 access and refresh tokens — the victim's account is modified to carry an attacker-controlled OAuth grant without any password compromise.