Account Manipulation `T1098`

Tactics: Persistence, Privilege Escalation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Events covered

51 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 13	RegistryEvent (Value Set)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4634	An account was logged off.
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4704	A user right was assigned.
Security-Auditing	Event ID 4706	A new trust was created to a domain.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4722	A user account was enabled.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.
Security-Auditing	Event ID 4724	An attempt was made to reset an account's password.
Security-Auditing	Event ID 4725	A user account was disabled.
Security-Auditing	Event ID 4726	A user account was deleted.
Security-Auditing	Event ID 4727	A security-enabled global group was created.
Security-Auditing	Event ID 4728	A member was added to a security-enabled global group.
Security-Auditing	Event ID 4729	A member was removed from a security-enabled global group.
Security-Auditing	Event ID 4730	A security-enabled global group was deleted.
Security-Auditing	Event ID 4731	A security-enabled local group was created.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4733	A member was removed from a security-enabled local group.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4754	A security-enabled universal group was created.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4757	A member was removed from a security-enabled universal group.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4794	An attempt was made to set the Directory Services Restore Mode administrator password.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
1Password-GroupMembership	gm-join	Join Group
1Password-GroupVaultAccess	any	Group vault access (catch-all)
1Password-UserVaultAccess	any	User vault access (catch-all)
Defender-DeviceEvents	UserAccountAddedToLocalGroup	User account added to local group
Defender-DeviceEvents	UserAccountCreated	User account created
Defender-DeviceEvents	UserAccountModified	User account modified
Defender-DeviceProcessEvents	any	Process activity
Defender-IdentityInfo	any	Identity information
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
MSSQLSERVER	Event ID 33205	Event ID 33205
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 599 rules share fields, values, and exclusions.

Fields filtered most (395 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	121	`eq` 121	`aws.cloudtrail`, `azure.auditlogs`, `gcp.audit`, `google_workspace.admin`, `o365.audit`
`EventType`	120	`eq` 75, `in` 39, `wildcard` 4, `is_not_null` 1, `starts_with` 1	`exec`, `AttachRolePolicy`, `CreateLoginProfile`, `ProcessRollup2`, `exec_event`
`event.outcome`	87	`eq` 87	`success`, `Success`, `failure`
`aws::eventName`	59	`in` 31, `eq` 28	`AttachGroupPolicy`, `AttachRolePolicy`, `AttachUserPolicy`, `PutGroupPolicy`, `PutRolePolicy`
`EventID`	55	`eq` 48, `in` 5, `regex_match` 3	`5136`, `4728`, `4720`, `4738`, `4688`
`Provider_Name`	52	`eq` 50, `in` 2	`iam.amazonaws.com`, `Exchange`, `bedrock.amazonaws.com`, `eks.amazonaws.com`, `Microsoft Entra ID`
`sourcetype`	41	`eq` 39, `in` 2	`o365:management:activity`, `azure:monitor:aad`, `aws:asl`, `aws:cloudtrail`, `vmw-syslog`
`aws::errorCode`	28	`is_null` 18, `eq` 5, `in` 3, `is_not_null` 2	, `AccessDenied`, `AccessDeniedException`, `DeleteConflictException`, `NoSuchEntityException`
`OperationName`	23	`eq` 17, `in` 5, `contains` 1	`Add app role assignment to service principal`, `Add member to role`, `Set domain authentication`, `Set federation settings on domain`, `Add delegated permission grant`
`operationName`	22	`eq` 18, `contains` 2, `starts_with` 2, `in` 1	`Add member to role`, `Update user`, `Add app role assignment to service principal`, `Add eligible member to role in PIM completed*`, `Add member to role completed (PIM activation)`
`Operation`	21	`eq` 15, `in` 6	`Add member to role.`, `New-InboxRule`, `Update application.`, `Add app role assignment to service principal.`, `Add eligible member to role.`
`aws::eventSource`	19	`eq` 18, `in` 1	`iam.amazonaws.com`, `rds.amazonaws.com`, `route53.amazonaws.com`, `cloudtrail.amazonaws.com`, `ec2.amazonaws.com`
`CommandLine`	18	`contains` 13, `in` 2, `regex_match` 2, `wildcard` 2, `ends_with` 1	`-Group` , `/add`, `(?i)(\-u)\|(user)\|(localgroup)\|(group)`, `(?i).add`, `administrateur`
`azure_ad::activity_display_name`	17	`eq` 12, `in` 3, `contains` 2	`Register device`, `Add device`, `Add registered owner to device`, `Add Windows Hello for Business credential`, `Add app role assignment to service principal`
`Category`	15	`eq` 14, `in` 1	`ApplicationManagement`, `RoleManagement`, `UserManagement`, `SQLSecurityAuditEvents`, `Semperis-Operation-Log`

Top indicator values (2199 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`Success` elasticAWS Bedrock AgentCore Resource Created with IAM Execution Role elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM Login Profile Created or Modified for an IAM User +50 more rules	65	306
`event.outcome`	`eq`	`success` elasticAccount Password Reset Remotely elasticAWS EKS Access Entry Created Then Deleted by Same Identity elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Credentials Added to a Bedrock API Key Phantom User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM User Self-Created Access Key Subsequently Used elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance or Cluster Password Modified elasticAWS S3 Bucket Policy Added to Share with External Account elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Deviceless Windows Hello Sign-in Followed by Device Registration +5 more rules	20	82
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS Bedrock Unauthorized Foundation Model Access Attempt elasticAWS Bedrock Unauthorized Resource-Based Policy Modification Attempt elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed +10 more rules	25	143
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID Application Credential Modified elasticEntra ID Device Registration with Phishing Kit Default OS Build elasticEntra ID Device Registration with ROADtools Default OS Build elasticEntra ID Domain Federation Configuration Change elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Guest Account Promoted to Member elasticEntra ID Privileged Identity Management (PIM) Role Modified elasticEntra ID Register Device with Unusual User Agent (Azure AD Join) elasticEntra ID Service Principal Credentials Created by Unusual User elasticEntra ID User Added as Registered Application Owner elasticEntra ID User Added as Service Principal Owner elasticEntra ID Windows Hello for Business Credential Registered	14	23
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP IAM Custom Role Creation elasticGCP IAM Service Account Impersonation Role Granted elasticGCP IAM Service Account Key Deletion elasticGCP Service Account Key Creation elasticGCP Storage Bucket Permissions Modification elasticGKE Certificate Signing Request API Client Signer Requested elasticGKE Client Certificate Signing Request Created or Approved elasticGKE Cluster-Admin Role Binding Created or Modified elasticGKE Creation of a RoleBinding Referencing a ServiceAccount elasticGKE Creation or Modification of Sensitive Role elasticGKE RBAC Wildcard Elevation on Existing Role elasticGKE Service Account Modified RBAC Objects elasticGKE Unusual Sensitive Workload Modification	13	60
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS EKS Access Entry Created Then Deleted by Same Identity elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Login Profile Added for Root elasticAWS IAM Roles Anywhere Trust Anchor Created with External CA elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM User Self-Created Access Key Subsequently Used elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token elasticAWS RDS DB Instance or Cluster Password Modified elasticAWS S3 Bucket Policy Added to Share with External Account	11	40
`data_stream.dataset`	`eq`	`google_workspace.admin` elasticApplication Added to Google Workspace Domain elasticGoogle Workspace Admin Role Assigned to a User or Group elasticGoogle Workspace API Access Granted via Domain-Wide Delegation elasticGoogle Workspace Custom Admin Role Created elasticGoogle Workspace Password Policy Modified elasticGoogle Workspace Role Modified elasticGoogle Workspace Suspended User Account Renewed elasticGoogle Workspace User Organizational Unit Changed	8	16
`data_stream.dataset`	`eq`	`o365.audit` elasticDeprecated - M365 Teams Guest Access Enabled elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Mailbox High-Risk Permission Delegated elasticM365 Exchange Management Group Role Assigned elasticM365 Identity Global Administrator Role Assigned elasticM365 Identity OAuth Illicit Consent Grant by Rare Client and User elasticM365 SharePoint Site Administrator Added	7	38
`aws::errorCode`	`is_null`	kustoAWSCloudTrail - Policy version set to default kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy +3 more rules	18	50
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 ApplicationImpersonation Role Assigned splunkO365 Elevated Mailbox Permission Assigned splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Mailbox Folder Read Permission Assigned splunkO365 Mailbox Folder Read Permission Granted splunkO365 Mailbox Read Access Granted to Application splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials splunkO365 Service Principal Privilege Escalation +1 more rules	16	80
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD Admin Consent Bypassed by Service Principal splunkAzure AD Application Administrator Role Assigned splunkAzure AD FullAccessAsApp Permission Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD New MFA Method Registered splunkAzure AD PIM Role Assigned splunkAzure AD PIM Role Assignment Activated splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkAzure AD Service Principal New Client Credentials splunkAzure AD Service Principal Owner Added splunkAzure AD Service Principal Privilege Escalation splunkAzure AD Tenant Wide Admin Consent Granted splunkAzure AD User Enabled And Password Reset splunkAzure AD User ImmutableId Attribute Updated	15	47
`aws::errorMessage`	`is_null`	kustoAWSCloudTrail - Policy version set to default kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	15	30
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed elasticAWS IAM SAML Provider Created elasticAWS IAM Sensitive Operations via Lambda Execution Role elasticAWS IAM User Addition to Group elasticAWS Sensitive IAM Operations Performed via CloudShell elasticAWS SES Full Access Policy Attached to IAM Entity by Unusual User	14	24
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM Credentials Added to a Bedrock API Key Phantom User elasticAWS IAM Login Profile Added for Root elasticAWS IAM User Created Access Keys For Another User elasticAWS IAM User Self-Created Access Key Subsequently Used elasticAWS IAM Virtual MFA Device Registration Attempt with Session Token	9	9
`aws::eventName`	`in`	`AttachGroupPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachRolePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachUserPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`CreatePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`CreatePolicyVersion` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`PutGroupPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutRolePolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutUserPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`security_result.action`	`eq`	`ALLOW` chronicleAWS IAM Activity By S3 Browser Utility chronicleAWS IAM Activity From EC2 Instance chronicleClient Secret Added to Entra ID Application chronicleEntra ID Add User Outside PIM chronicleEntra ID Add User To Admin Role chronicleEntra ID Recently Created User Assigned an Entra ID Role chronicleGCP Admin Privileged Roles Added To Service Accounts chronicleGCP IAM Organization Policy Updated Or Deleted chronicleGoogle Cloud Service Account Key Created or Uploaded chronicleO365 AD PowerShell App Login Subsequent Activity chronicleO365 Add User To Admin Role chronicleO365 Entra ID App Client Secret Added, Updated or Deleted chronicleO365 Recently Created Entra ID User Assigned Roles	13	102
`Workload`	`eq`	`AzureActiveDirectory` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials	9	30
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaAWS IAM Backdoor Users Keys sigmaAWS User Login Profile Was Modified sigmaIAM Access Key Created sigmaIAM Access Key Creation Attempt sigmaIAM Admin Policy Attached sigmaIAM Login Profile Created sigmaIAM Policy Attachment Attempt splunkAWS IAM Failure Group Deletion splunkAWS IAM Successful Group Deletion	9	22
`ServiceName`	`eq`	`k8s.io` elasticGKE Certificate Signing Request API Client Signer Requested elasticGKE Client Certificate Signing Request Created or Approved elasticGKE Cluster-Admin Role Binding Created or Modified elasticGKE Creation of a RoleBinding Referencing a ServiceAccount elasticGKE Creation or Modification of Sensitive Role elasticGKE RBAC Wildcard Elevation on Existing Role elasticGKE Service Account Modified RBAC Objects elasticGKE Unusual Sensitive Workload Modification	8	28
`metadata.log_type`	`eq`	`SAP_CHANGE_DOCUMENT` chroniclesap change documents sensitive profile assignment chroniclesap change documents sensitive profile assignment data table chroniclesap change documents sensitive role assignment chroniclesap critial role assigned to new user chroniclesap critical authorization value changed chroniclesap critical role assigned to new user chroniclesap sensitive role assignment correlation chroniclesap sensitive role authorization modification	8	8
`event.type`	`eq`	`start` elasticLinux User Account Credential Modification elasticLinux User Added to Privileged Group elasticNew ActiveSyncAllowedDeviceID Added via PowerShell elasticOpenSSL Password Hash Generation elasticPod or Container Creation with Suspicious Command-Line elasticPotential Linux Backdoor User Account Creation elasticSuspicious Echo or Printf Execution Detected via Defend for Containers	7	1036
`AttributeLDAPDisplayName`	`eq`	`servicePrincipalName` sigmaActive Directory User Backdoors sigmaSuspicious modification of a fake domain controller SPN (DCshadow) (Directory Services) sigmaSuspicious modification of a user account SPN to enable Kerberoast attack elasticUser account exposed to Kerberoasting splunkWindows AD ServicePrincipalName Added To Domain Account splunkWindows AD Short Lived Domain Account ServicePrincipalName	6	8
`OperationType`	`eq`	`%%14674` sigmaSuspicious modification of a fake domain controller SPN (DCshadow) (Directory Services) sigmaSuspicious modification of a user account SPN to enable Kerberoast attack elasticAdminSDHolder SDProp Exclusion Added elasticModification of the msPKIAccountCredentials elasticUser account exposed to Kerberoasting splunkWindows AD ServicePrincipalName Added To Domain Account	6	16

Exclusions (276 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userAgent`	`contains`	`Pulumi` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS S3 Bucket Policy Added to Share with External Account	11
`aws::userAgent`	`contains`	`Terraform` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added to User elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed elasticAWS Route 53 Private Hosted Zone Associated With a VPC elasticAWS S3 Bucket Policy Added to Share with External Account	11
`aws::userAgent`	`contains`	`Ansible` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	5
`aws::errorCode`	`is_not_null`	sigmaIAM Access Key Created sigmaIAM Admin Policy Attached pantherAWS Network ACL Overly Permissive Entry Created pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherNew IAM Credentials Updated	6
`aws::userIdentity.type`	`eq`	`AWSService` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	5
`AllowedToDelegateTo`	`eq`	`-` sigmaActive Directory User Backdoors sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Any protocol sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Kerberos only sigmaHost set with constrained delegation	4
`SubjectUserSid`	`eq`	`S-1-5-18` sigmaHigh risk local/domain local group membership change sigmaMedium risk local/domain local group membership change sigmaPrivilege SeMachineAccountPrivilege abuse elasticModification of the msPKIAccountCredentials	4
`aws::errorMessage`	`is_not_null`	pantherAWS Network ACL Overly Permissive Entry Created pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherNew IAM Credentials Updated	4
`aws::sourceIPAddress`	`in`	`cloudformation.amazonaws.com` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::sourceIPAddress`	`in`	`servicecatalog.amazonaws.com` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::userIdentity.arn`	`contains`	`terraform` elasticAWS EKS Access Entry Modified elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`responseStatus`	`is_not_null`	pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`ge`	`1` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`ge`	`400` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`le`	`16` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4

Account Manipulation `T1098`

Events covered

Authoring guide

Fields filtered most (395 distinct)

Top indicator values (2199 distinct)

Exclusions (276 distinct)

Rules under this technique

Sigma 101 rules

Elastic 181 rules

Splunk 70 rules

Kusto 135 rules

YARA-L 29 rules

Panther 83 rules

Account Manipulation T1098

Events covered

Authoring guide

Fields filtered most (395 distinct)

Top indicator values (2199 distinct)

Exclusions (276 distinct)

Rules under this technique

Sigma 101 rules

Elastic 181 rules

Splunk 70 rules

Kusto 135 rules

YARA-L 29 rules

Panther 83 rules

Account Manipulation `T1098`