Account Manipulation `T1098`

Tactics: Persistence, Privilege Escalation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Events covered

41 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 13	RegistryEvent (Value Set)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4634	An account was logged off.
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4704	A user right was assigned.
Security-Auditing	Event ID 4706	A new trust was created to a domain.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4722	A user account was enabled.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.
Security-Auditing	Event ID 4724	An attempt was made to reset an account's password.
Security-Auditing	Event ID 4725	A user account was disabled.
Security-Auditing	Event ID 4726	A user account was deleted.
Security-Auditing	Event ID 4727	A security-enabled global group was created.
Security-Auditing	Event ID 4728	A member was added to a security-enabled global group.
Security-Auditing	Event ID 4729	A member was removed from a security-enabled global group.
Security-Auditing	Event ID 4730	A security-enabled global group was deleted.
Security-Auditing	Event ID 4731	A security-enabled local group was created.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4733	A member was removed from a security-enabled local group.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4754	A security-enabled universal group was created.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4757	A member was removed from a security-enabled universal group.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4794	An attempt was made to set the Directory Services Restore Mode administrator password.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
Defender-DeviceEvents	UserAccountAddedToLocalGroup	User account added to local group
MSSQLSERVER	Event ID 33205	Event ID 33205
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create

Authoring guide

Patterns shared across the 548 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (421 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

Field	Rules	How	Sample values
`EventType`	95	`eq` 66, `in` 24, `wildcard` 3, `contains` 1, `is_not_null` 1, `starts_with` 1	`exec`, `AttachRolePolicy`, `ProcessRollup2`, `exec_event`, `AddRoleToInstanceProfile`
`data_stream.dataset`	94	`eq` 94	`aws.cloudtrail`, `azure.auditlogs`, `google_workspace.admin`, `o365.audit`, `kubernetes.audit_logs`
`event.outcome`	62	`eq` 52, `in` 10	`success`, `Success`, `failure`
`aws::eventName`	59	`in` 31, `eq` 28	`AttachGroupPolicy`, `AttachRolePolicy`, `AttachUserPolicy`, `PutGroupPolicy`, `PutRolePolicy`
`EventID`	54	`eq` 45, `in` 8, `regex_match` 3	`4728`, `4732`, `5136`, `4720`, `4688`
`Provider_Name`	45	`eq` 43, `in` 2	`iam.amazonaws.com`, `admin`, `Exchange`, `bedrock.amazonaws.com`, `eks.amazonaws.com`
`sourcetype`	41	`eq` 39, `in` 2	`o365:management:activity`, `azure:monitor:aad`, `aws:asl`, `aws:cloudtrail`, `vmw-syslog`
`aws::errorCode`	39	`is_null` 29, `eq` 5, `in` 3, `is_not_null` 2	`AccessDenied`, `AccessDeniedException`, `DeleteConflictException`, `NoSuchEntityException`, `success`
`aws::errorMessage`	26	`is_null` 26
`Action`	22	`contains` 22, `starts_with` 12	`dynamodb:create`, `kms:delete`, `cloudformation:`, `cloudformation:create`, `cloudformation:createstack`
`Condition`	22	`eq` 20, `is_null` 2
`Effect`	22	`eq` 22	`Allow`
`Operation`	22	`eq` 16, `in` 6	`Add member to role.`, `New-InboxRule`, `Add-MailboxFolderPermission`, `Add-MailboxPermission`, `Update application.`
`Resource`	22	`eq` 22	`*`
`OperationName`	21	`eq` 15, `in` 4, `contains` 2	`Add member to role`, `Add app role assignment to service principal`, `Add eligible member to role`, `Library.ServiceConnectionExecuted`, `Set domain authentication`

Top indicator values (1996 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAccount Password Reset Remotely elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Login Profile Added to User elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM SAML Provider Created elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS IAM User Addition to Group elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance or Cluster Password Modified elasticAWS Route 53 Domain Transfer Lock Disabled elasticAWS Route 53 Domain Transferred to Another Account elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account elasticDeprecated - M365 Teams Guest Access Enabled elasticEntra ID Domain Federation Configuration Change elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Service Principal Credentials Created by Unusual User elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticGCP IAM Custom Role Creation elasticGCP IAM Service Account Key Deletion elasticGCP Service Account Key Creation elasticGCP Storage Bucket Permissions Modification elasticGoogle Workspace API Access Granted via Domain-Wide Delegation elasticLinux Group Creation elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Mailbox High-Risk Permission Delegated elasticM365 Exchange Management Group Role Assigned elasticM365 Exchange MFA Notification Email Deleted or Moved elasticM365 Identity Global Administrator Role Assigned elasticM365 Identity OAuth Illicit Consent Grant by Rare Client and User elasticM365 SharePoint Site Administrator Added elasticUnusual Login via System User	50	251
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS Bedrock Unauthorized Foundation Model Access Attempt elasticAWS Bedrock Unauthorized Resource-Based Policy Modification Attempt elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Roles Anywhere Profile Creation elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM SAML Provider Created elasticAWS IAM User Addition to Group elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance or Cluster Password Modified elasticAWS Route 53 Domain Transfer Lock Disabled elasticAWS Route 53 Domain Transferred to Another Account elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS S3 Bucket Policy Added to Share with External Account elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS STS AssumeRoot by Rare User and Member Account	28	141
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID Application Credential Modified elasticEntra ID Device Registration with ROADtools Default OS Build elasticEntra ID Domain Federation Configuration Change elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified elasticEntra ID Protection User Alert and Device Registration elasticEntra ID Register Device with Unusual User Agent (Azure AD Join) elasticEntra ID Service Principal Credentials Created by Unusual User elasticEntra ID Unusual Cloud Device Registration elasticEntra ID User Added as Registered Application Owner elasticEntra ID User Added as Service Principal Owner	13	20
`data_stream.dataset`	`eq`	`google_workspace.admin` elasticApplication Added to Google Workspace Domain elasticExternal User Added to Google Workspace Group elasticGoogle Workspace Admin Role Assigned to a User elasticGoogle Workspace API Access Granted via Domain-Wide Delegation elasticGoogle Workspace Custom Admin Role Created elasticGoogle Workspace Password Policy Modified elasticGoogle Workspace Role Modified elasticGoogle Workspace Suspended User Account Renewed elasticGoogle Workspace User Organizational Unit Changed	9	18
`data_stream.dataset`	`eq`	`o365.audit` elasticDeprecated - M365 Teams Guest Access Enabled elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Mailbox High-Risk Permission Delegated elasticM365 Exchange Management Group Role Assigned elasticM365 Exchange MFA Notification Email Deleted or Moved elasticM365 Identity Global Administrator Role Assigned elasticM365 Identity OAuth Flow by User Sign-in to Device Registration elasticM365 Identity OAuth Illicit Consent Grant by Rare Client and User elasticM365 SharePoint Site Administrator Added	9	45
`data_stream.dataset`	`eq`	`kubernetes.audit_logs` elasticEKS Authentication Configuration Modified elasticKubernetes Client Certificate Signing Request Created or Approved elasticKubernetes Cluster-Admin Role Binding Created elasticKubernetes Creation of a RoleBinding Referencing a ServiceAccount elasticKubernetes Sensitive RBAC Change Followed by Workload Modification elasticKubernetes Service Account Modified RBAC Objects elasticUnusual Kubernetes Sensitive Workload Modification	7	36
`Effect`	`eq`	`Allow` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	22	27
`Resource`	`eq`	`*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	22	23
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Login Profile Added to User elasticAWS IAM SAML Provider Created elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS IAM User Addition to Group elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS Sensitive IAM Operations Performed via CloudShell	16	25
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 ApplicationImpersonation Role Assigned splunkO365 Elevated Mailbox Permission Assigned splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Mailbox Folder Read Permission Assigned splunkO365 Mailbox Folder Read Permission Granted splunkO365 Mailbox Read Access Granted to Application splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials splunkO365 Service Principal Privilege Escalation splunkO365 Tenant Wide Admin Consent Granted	16	80
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD Admin Consent Bypassed by Service Principal splunkAzure AD Application Administrator Role Assigned splunkAzure AD FullAccessAsApp Permission Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD New MFA Method Registered splunkAzure AD PIM Role Assigned splunkAzure AD PIM Role Assignment Activated splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkAzure AD Service Principal New Client Credentials splunkAzure AD Service Principal Owner Added splunkAzure AD Service Principal Privilege Escalation splunkAzure AD Tenant Wide Admin Consent Granted splunkAzure AD User Enabled And Password Reset splunkAzure AD User ImmutableId Attribute Updated	15	47
`aws::eventName`	`in`	`AttachGroupPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachRolePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachUserPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`CreatePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`CreatePolicyVersion` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`PutGroupPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutRolePolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutUserPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`security_result.action`	`eq`	`ALLOW` chronicleAWS IAM Activity By S3 Browser Utility chronicleAWS IAM Activity From EC2 Instance chronicleClient Secret Added to Entra ID Application chronicleEntra ID Add User Outside PIM chronicleEntra ID Add User To Admin Role chronicleEntra ID Recently Created User Assigned an Entra ID Role chronicleGCP Admin Privileged Roles Added To Service Accounts chronicleGCP IAM Organization Policy Updated Or Deleted chronicleGoogle Cloud Service Account Key Created or Uploaded chronicleO365 AD PowerShell App Login Subsequent Activity chronicleO365 Add User To Admin Role chronicleO365 Entra ID App Client Secret Added, Updated or Deleted chronicleO365 Recently Created Entra ID User Assigned Roles	13	102
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaAWS IAM Backdoor Users Keys sigmaAWS User Login Profile Was Modified sigmaIAM Access Key Created sigmaIAM Access Key Creation Attempt sigmaIAM Admin Policy Attached sigmaIAM Login Profile Created sigmaIAM Policy Attachment Attempt splunkAWS IAM Failure Group Deletion splunkAWS IAM Successful Group Deletion pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherDEPRECATED - AWS User Login Profile Modified	12	28
`Action`	`contains`	`iam:passrole` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Action`	`starts_with`	`iam:` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Workload`	`eq`	`AzureActiveDirectory` sigmaUser Added to an Administrator's Azure AD Role splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials	10	31
`event.outcome`	`in`	`Success` elasticAzure Event Hub Authorization Rule Created or Updated elasticAzure Kubernetes Services (AKS) Kubernetes Rolebindings Created elasticAzure Storage Account Key Regenerated elasticAzure VM Extension Deployment by User elasticEntra ID Application Credential Modified elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified elasticEntra ID Register Device with Unusual User Agent (Azure AD Join) elasticEntra ID User Added as Registered Application Owner elasticEntra ID User Added as Service Principal Owner	10	37
`event.outcome`	`in`	`success` elasticAzure Event Hub Authorization Rule Created or Updated elasticAzure Kubernetes Services (AKS) Kubernetes Rolebindings Created elasticAzure Storage Account Key Regenerated elasticAzure VM Extension Deployment by User elasticEntra ID Application Credential Modified elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Privileged Identity Management (PIM) Role Modified elasticEntra ID Register Device with Unusual User Agent (Azure AD Join) elasticEntra ID User Added as Registered Application Owner elasticEntra ID User Added as Service Principal Owner	10	38
`kubernetes.audit.annotations.authorization_k8s_io/decision`	`eq`	`allow` elasticEKS Authentication Configuration Modified elasticKubernetes Client Certificate Signing Request Created or Approved elasticKubernetes Cluster-Admin Role Binding Created elasticKubernetes Creation of a RoleBinding Referencing a ServiceAccount elasticKubernetes Creation or Modification of Sensitive Role elasticKubernetes RBAC Wildcard Elevation on Existing Role elasticKubernetes Service Account Modified RBAC Objects elasticUnusual Kubernetes Sensitive Workload Modification	8	23
`metadata.log_type`	`eq`	`SAP_CHANGE_DOCUMENT` chroniclesap change documents sensitive profile assignment chroniclesap change documents sensitive profile assignment data table chroniclesap change documents sensitive role assignment chroniclesap critial role assigned to new user chroniclesap critical authorization value changed chroniclesap critical role assigned to new user chroniclesap sensitive role assignment correlation chroniclesap sensitive role authorization modification	8	8
`OperationType`	`eq`	`%%14674` sigmaSuspicious modification of a fake domain controller SPN (DCshadow) (Directory Services) sigmaSuspicious modification of a user account SPN to enable Kerberoast attack elasticAccount Configured with Never-Expiring Password elasticAdminSDHolder SDProp Exclusion Added elasticModification of the msPKIAccountCredentials elasticUser account exposed to Kerberoasting splunkWindows AD ServicePrincipalName Added To Domain Account	7	17
`kubernetes.audit.verb`	`in`	`patch` elasticEKS Authentication Configuration Modified elasticKubernetes Client Certificate Signing Request Created or Approved elasticKubernetes Creation or Modification of Sensitive Role elasticKubernetes RBAC Wildcard Elevation on Existing Role elasticKubernetes Sensitive RBAC Change Followed by Workload Modification elasticKubernetes Service Account Modified RBAC Objects elasticUnusual Kubernetes Sensitive Workload Modification	7	20

Exclusions (215 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

Field	Kind	Value	Rules excluding
`AllowedToDelegateTo`	`eq`	`-` sigmaActive Directory User Backdoors sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Any protocol sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Kerberos only sigmaHost set with constrained delegation	4
`SubjectUserSid`	`eq`	`S-1-5-18` sigmaHigh risk local/domain local group membership change sigmaMedium risk local/domain local group membership change sigmaPrivilege SeMachineAccountPrivilege abuse elasticModification of the msPKIAccountCredentials	4
`responseStatus.code`	`ge`	`1` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`ge`	`400` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`le`	`16` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`username`	`in`	`aksService` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`username`	`in`	`masterclient` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`username`	`starts_with`	`system:` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`SubjectUserName`	`ends_with`	`$` sigmaSuspicious modification of a computer account SPN sigmaSuspicious modification of a fake domain controller SPN (DCshadow) sigmaUser Added to Local Administrator Group	3
`verb`	`ne`	`create` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created	3
`EventData`	`contains`	`s-1-5-32-555` kustoGroup created then added to built in domain local or global group kustoUser account added to built in domain local or global group	2
`NewTargetUserName`	`ends_with`	`$` sigmaComputer account renamed without a trailing $ (CVE-2021-42278/42287) elasticPotential Privileged Escalation via SamAccountName Spoofing	2
`OldTargetUserName`	`ends_with`	`$` sigmaComputer account renamed without a trailing $ (CVE-2021-42278/42287) sigmaUser account creation disguised in a computer account	2
`ProviderName`	`contains`	`asi` kustoShadow Credentials Added to Account kustoShadow Credentials Added to Account (Alternative)	2
`SubjectUserName`	`eq`	`%sap_admin_users.user` chroniclesap sensitive role assignment correlation chroniclesap sensitive role authorization modification	2

`j` / `k`	Scroll down / up
`d` / `u`	Half-page down / up
`gg` / `G`	Top / bottom
`h` / `l`	History back / forward
`f`	Follow link (`Shift` = new tab)
`/`	Focus search
`?`	Toggle this help
`↑` / `↓`	Navigate search results
`Enter`	Open highlighted result
`Esc`	Close results / dialog

`type:`	`events` / `rules` / `providers`
`vendor:`	`sigma` / `elastic` / `splunk` / `kusto` / `chronicle` (vendor name alone also works: `sigma:`, `kql:`, `secops:`…)
`tactic:`	TA-id, slug, or name: `credential_access`, `TA0006`
`technique:`	technique or sub-technique ID: `T1003`, `T1003.001` (alias `tech:`)
`severity:`	`critical` / `high` / `medium` / `low` / `informational` (alias `sev:`)
`risk_score`	Numeric comparison on the Elastic risk score (0 to 100): `risk_score>50`, `risk_score<=20`, `risk_score=99` (alias `risk`; Elastic rules only)
`stages:`	Rules with exactly N pipeline stages
`correlation:`	`single_event` / `sequence` / `alternatives` / `alternatives_cross_log` / `all_required` / `correlated`
`with:`	Co-occurrence event-id; stacks (`with:4624 with:4769`) to require all, while a comma list in one occurrence (`with:4624,4769`) is an either-or group. Implies multi-event
`like:`	Structural neighbors of a rule slug (equivalents + subsumption stricter / broader): `like:comsvcs_lsass_memory_dump-splunk-sysmon`
`groupby:`	Entity-grouping substring match against `group_by_keys`: `groupby:user`, `groupby:host`
`uses:`	Rules whose predicate tree touches the field (any kind, any value): `uses:CommandLine`
`excludes:`	Rules with top-level `not()` clauses on the field (FP whitelists): `excludes:ParentImage`
`field:` / `value:`	Predicate search; narrows rule cards to those with a matching leaf and drives the indicator tier. Unquoted = substring, wildcards allowed (`value:mimikatz`)
`indicator:`	Shorthand for `field:F value:V`: `indicator:Image=*\powershell.exe`
`kind:`	Filter by predicate kind. Narrows rule cards to those carrying a matching predicate leaf (`vendor:elastic kind:cidr_match`) and drives the indicator tier: `contains` / `starts_with` / `ends_with` / `regex` / `cidr` / `eq` / `in` … (operator aliases `op:`/`match:`)
`has:` / `no:`	`sample`, `field`, `notes`, `refs`, `trace`, `thirdparty`, `rule`, `pattern`, `timewindow`, `threshold`, `newterms`, `sigma`/`elastic`/`splunk`/`kusto`/`chronicle`
`-op:val`	Exclude matches; works on most operators but not `type:`/`like:`/`has:`/`no:` (use `no:<flag>` to exclude a rule flag): `tactic:execution -vendor:splunk`. Standalone `-kind:`/`-field:`/`-value:` drop every rule carrying a matching predicate leaf (`type:rules -kind:is_null`)
`field:"…"` / `value:"…"`	Quoted value = anchored exact match (also allows spaces): `value:"net user"`
`a,b`	Comma = OR inside one operator (`vendor:sigma,elastic`, `severity:high,critical`); repeating a facet merges the same way. `field:`/`value:` never split (literal commas)
`vendors:` / `stage:`	Singular and plural spellings fold to the canonical operator and value: `tactics:` = `tactic:`, `type:event` = `type:events`, `correlation:sequences` = `correlation:sequence`, `has:thresholds` = `has:threshold`
`"quoted phrase"`	Exact-match a multi-word phrase (free text)

Account Manipulation `T1098`

Events covered

Authoring guide

Fields filtered most (421 distinct)

Top indicator values (1996 distinct)

Exclusions (215 distinct)

Rules under this technique

Sigma 100 rules

Elastic 150 rules

Splunk 71 rules

Kusto 115 rules

YARA-L 29 rules

Panther 83 rules

Keyboard shortcuts

Search operators

Account Manipulation T1098

Events covered

Authoring guide

Fields filtered most (421 distinct)

Top indicator values (1996 distinct)

Exclusions (215 distinct)

Rules under this technique

Sigma 100 rules

Elastic 150 rules

Splunk 71 rules

Kusto 115 rules

YARA-L 29 rules

Panther 83 rules

Account Manipulation `T1098`