Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0096 — Account Manipulation Behavior Chain Detection
DET0096

Account Manipulation Behavior Chain Detection

6 analytic(s) · 1 technique(s) detected

Analytics

6
AN0265 Analytic 0265
Windows

Account attribute changes (e.g., password set, group membership, servicePrincipalName, logon hours) correlated with unusual process lineage or timing, indicating privilege escalation or persistence via valid accounts.

WinEventLog:Security EventCode=4738, 4728, 4670 WinEventLog:Sysmon EventCode=1
[TimeWindow] Time between suspicious process and account change (e.g., 5m).
[HighPrivilegeGroupList] Customize group list (e.g., Domain Admins, Enterprise Admins) to monitor.
[SubjectTargetMismatch] Flag if account modifier != modified user (potential hijack).
AN0266 Analytic 0266
Linux

Use of native tools or scripting (e.g., `usermod`, `passwd`, `groupmod`) to escalate permissions or persist access on existing users, correlated with login or process events.

auditd:SYSCALL usermod, groupmod, passwd auditd:PATH /etc/passwd or /etc/group file write
[SudoPath] Common sudo or privilege escalation paths (e.g., `/usr/bin/passwd`).
[ModifiedShellList] Detect if user shell is changed to unusual one (e.g., /bin/sh -> /bin/bash).
AN0267 Analytic 0267
macOS

Modifications to user accounts via `dscl`, `pwpolicy`, or System Preferences CLI (`sysadminctl`) that alter user groups, enable root, or bypass MDM restrictions.

macos:unifiedlog com.apple.accountsd, com.apple.opendirectoryd
[ModifiedUserList] Track known non-system user UIDs or service accounts.
[GroupMembershipChanges] List of sensitive groups (admin, _developer, _analyticsd).
AN0268 Analytic 0268
Identity Provider

Modifications to SSO/SAML user attributes (e.g., `isAdmin`, `role`, MFA bypass, App assignments) often through CLI, API, or rogue IdP apps.

saas:okta User Attribute Modified / Role Assignment Changed
[RoleAssignmentBaseline] Expected user-role pairings per app or org unit.
[APIUsageContext] Caller identity or IP address ranges for identity admin actions.
AN0269 Analytic 0269
ESXi

Addition of new users or changes to role permissions (e.g., ReadOnly -> Admin) via API or vSphere Client, particularly from non-jumpbox IPs.

esxi:vpxa vim.SessionManager.login / vim.AccountManager.createUser
[VMAdminAccountName] Expected account name patterns for ESXi/vCenter admins.
[NetworkAccessLocation] Expected IPs/subnets for legitimate ESXi access.
AN0270 Analytic 0270
SaaS

Role escalation (e.g., Editor → Owner) in cloud collaboration tools (Google Workspace, O365) or file sharing apps to maintain elevated access.

m365:unified Admin Activity > Role Change or Sharing Change
[SharingSensitivityLabel] Threshold for labeling sensitive document access escalation.
[CrossOrgChanges] Track changes made across organizational boundaries (e.g., guest users).

Detected Techniques

1

Details

MITRE ID
DET0096
STIX ID
x-mitre-detection-strategy--d6c4cc3b-6875-4288-8193-bf4c864560ab
Analytics
6
Techniques Detected
1
By Tactic
Persistence
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.