Account Manipulation `T1098`

Tactics: Persistence, Privilege Escalation

Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials.

Events covered

51 catalog events are tagged with this technique by at least one rule.

Provider	Event	Title
Sysmon	Event ID 1	Process creation
Sysmon	Event ID 13	RegistryEvent (Value Set)
Security-Auditing	Event ID 4624	An account was successfully logged on.
Security-Auditing	Event ID 4625	An account failed to log on.
Security-Auditing	Event ID 4634	An account was logged off.
Security-Auditing	Event ID 4662	An operation was performed on an object.
Security-Auditing	Event ID 4663	An attempt was made to access an object.
Security-Auditing	Event ID 4673	A privileged service was called.
Security-Auditing	Event ID 4688	A new process has been created.
Security-Auditing	Event ID 4704	A user right was assigned.
Security-Auditing	Event ID 4706	A new trust was created to a domain.
Security-Auditing	Event ID 4720	A user account was created.
Security-Auditing	Event ID 4722	A user account was enabled.
Security-Auditing	Event ID 4723	An attempt was made to change an account's password.
Security-Auditing	Event ID 4724	An attempt was made to reset an account's password.
Security-Auditing	Event ID 4725	A user account was disabled.
Security-Auditing	Event ID 4726	A user account was deleted.
Security-Auditing	Event ID 4727	A security-enabled global group was created.
Security-Auditing	Event ID 4728	A member was added to a security-enabled global group.
Security-Auditing	Event ID 4729	A member was removed from a security-enabled global group.
Security-Auditing	Event ID 4730	A security-enabled global group was deleted.
Security-Auditing	Event ID 4731	A security-enabled local group was created.
Security-Auditing	Event ID 4732	A member was added to a security-enabled local group.
Security-Auditing	Event ID 4733	A member was removed from a security-enabled local group.
Security-Auditing	Event ID 4738	A user account was changed.
Security-Auditing	Event ID 4741	A computer account was created.
Security-Auditing	Event ID 4742	A computer account was changed.
Security-Auditing	Event ID 4754	A security-enabled universal group was created.
Security-Auditing	Event ID 4756	A member was added to a security-enabled universal group.
Security-Auditing	Event ID 4757	A member was removed from a security-enabled universal group.
Security-Auditing	Event ID 4781	The name of an account was changed.
Security-Auditing	Event ID 4794	An attempt was made to set the Directory Services Restore Mode administrator password.
Security-Auditing	Event ID 5136	A directory service object was modified.
Security-Auditing	Event ID 5137	A directory service object was created.
Security-Auditing	Event ID 5145	A network share object was checked to see whether client can be granted desired access.
1Password-GroupMembership	gm-join	Join Group
1Password-GroupVaultAccess	any	Group vault access (catch-all)
1Password-UserVaultAccess	any	User vault access (catch-all)
Defender-DeviceEvents	UserAccountAddedToLocalGroup	User account added to local group
Defender-DeviceEvents	UserAccountCreated	User account created
Defender-DeviceEvents	UserAccountModified	User account modified
Defender-DeviceProcessEvents	any	Process activity
Defender-IdentityInfo	any	Identity information
Linux-Auditd	Event ID 1302	PATH
Linux-Auditd	Event ID 1307	CWD
MSSQLSERVER	Event ID 33205	Event ID 33205
PowerShell	Event ID 4103	Payload Context: ContextInfo User Data: UserData.
PowerShell	Event ID 4104	Creating Scriptblock text (MessageNumber of MessageTotal).
PowerShell	Event ID 800	Event ID 800
Sysmon-for-Linux	Event ID 1	Process Create
Sysmon-for-Linux	Event ID 11	File created

Authoring guide

These 587 rules share fields, values, and exclusions.

Fields filtered most (464 distinct)

These fields appear most often in rule filters.

Field	Rules	How	Sample values
`data_stream.dataset`	117	`eq` 117	`aws.cloudtrail`, `azure.auditlogs`, `gcp.audit`, `google_workspace.admin`, `o365.audit`
`EventType`	115	`eq` 72, `in` 37, `wildcard` 4, `is_not_null` 1, `starts_with` 1	`exec`, `ProcessRollup2`, `exec_event`, `io.k8s.certificates.v1.certificatesigningrequests.create`, `createaccesskey`
`event.outcome`	81	`eq` 81	`success`, `failure`
`aws::eventName`	59	`in` 31, `eq` 28	`AttachGroupPolicy`, `AttachRolePolicy`, `AttachUserPolicy`, `PutGroupPolicy`, `PutRolePolicy`
`EventID`	58	`eq` 49, `in` 8, `regex_match` 3	`4728`, `5136`, `4732`, `4720`, `4738`
`Provider_Name`	48	`eq` 46, `in` 2	`iam.amazonaws.com`, `bedrock.amazonaws.com`, `exchange`, `eks.amazonaws.com`, `microsoft entra id`
`sourcetype`	41	`eq` 39, `in` 2	`o365:management:activity`, `azure:monitor:aad`, `aws:asl`, `aws:cloudtrail`, `vmw-syslog`
`aws::errorCode`	39	`is_null` 29, `eq` 5, `in` 3, `is_not_null` 2	`accessdenied`, `accessdeniedexception`, `deleteconflictexception`, `nosuchentityexception`, `success`
`Action`	26	`contains` 22, `eq` 4	`CREATE`, `kms:delete`, `cloudformation:`, `cloudformation:create`, `cloudformation:createstack`
`aws::errorMessage`	26	`is_null` 26
`type`	25	`eq` 21, `in` 4, `starts_with` 1	`user`, `serviceprincipal`, `API_KEY`, `OAUTH_CLIENT`, `AUTH_KEY`
`OperationName`	24	`eq` 17, `in` 5, `contains` 2	`add app role assignment to service principal`, `add member to role`, `set domain authentication`, `set federation settings on domain`, `Library.ServiceConnectionExecuted`
`host.os.type`	24	`eq` 24
`Condition`	22	`eq` 20, `is_null` 2
`Effect`	22	`eq` 22	`allow`

Top indicator values (2227 distinct)

These values appear most often in rule predicates.

Field	Kind	Value	Rules (here)	Corpus reach
`event.outcome`	`eq`	`success` elasticAccount Password Reset Remotely elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS EC2 CreateKeyPair by New Principal from Non-Cloud AS Organization elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Credentials Added to a Bedrock API Key Phantom User elasticAWS IAM Customer Managed Policy Version Created or Default Version Set +64 more rules	79	369
`data_stream.dataset`	`eq`	`aws.cloudtrail` elasticAWS Bedrock Foundation Model Access Enabled or Entitlement Granted elasticAWS Bedrock Resource-Based Policy Modified or Deleted elasticAWS Bedrock Unauthorized Foundation Model Access Attempt elasticAWS Bedrock Unauthorized Resource-Based Policy Modification Attempt elasticAWS EC2 Instance Connect SSH Public Key Uploaded elasticAWS EKS Access Entry Granted Cluster Admin Policy elasticAWS EKS Access Entry Modified elasticAWS First Occurrence of STS GetFederationToken Request by User elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group +18 more rules	33	169
`data_stream.dataset`	`eq`	`azure.auditlogs` elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Application Credential Modified elasticEntra ID Device Registration with Phishing Kit Default OS Build elasticEntra ID Device Registration with ROADtools Default OS Build elasticEntra ID Domain Federation Configuration Change elasticEntra ID Elevated Access to User Access Administrator elasticEntra ID Global Administrator Role Assigned elasticEntra ID Global Administrator Role Assigned (PIM User) elasticEntra ID Guest Account Promoted to Member elasticEntra ID Multiple Device Registrations by a Single User elasticEntra ID Privileged Identity Management (PIM) Role Modified elasticEntra ID Protection User Alert and Device Registration elasticEntra ID Register Device with Unusual User Agent (Azure AD Join) elasticEntra ID Service Principal Credentials Created by Unusual User elasticEntra ID Unusual Cloud Device Registration +2 more rules	17	26
`data_stream.dataset`	`eq`	`gcp.audit` elasticGCP IAM Custom Role Creation elasticGCP IAM Service Account Impersonation Role Granted elasticGCP IAM Service Account Key Deletion elasticGCP Service Account Key Creation elasticGCP Storage Bucket Permissions Modification elasticGKE Certificate Signing Request API Client Signer Requested elasticGKE Certificate Signing Request for Privileged Identity elasticGKE Certificate Signing Request Self-Approved elasticGKE Client Certificate Signing Request Created or Approved elasticGKE Cluster-Admin Role Binding Created or Modified elasticGKE Creation of a RoleBinding Referencing a ServiceAccount elasticGKE Creation or Modification of Sensitive Role elasticGKE RBAC Wildcard Elevation on Existing Role elasticGKE Sensitive RBAC Change Followed by Workload Modification elasticGKE Service Account Modified RBAC Objects +1 more rules	16	69
`data_stream.dataset`	`eq`	`google_workspace.admin` elasticApplication Added to Google Workspace Domain elasticExternal User Added to Google Workspace Group elasticGoogle Workspace Admin Role Assigned to a User or Group elasticGoogle Workspace API Access Granted via Domain-Wide Delegation elasticGoogle Workspace Custom Admin Role Created elasticGoogle Workspace Password Policy Modified elasticGoogle Workspace Role Modified elasticGoogle Workspace Suspended User Account Renewed elasticGoogle Workspace User Organizational Unit Changed	9	18
`data_stream.dataset`	`eq`	`o365.audit` elasticDeprecated - M365 Teams Guest Access Enabled elasticM365 Exchange Mailbox Audit Logging Bypass Added elasticM365 Exchange Mailbox High-Risk Permission Delegated elasticM365 Exchange Management Group Role Assigned elasticM365 Exchange MFA Notification Email Deleted or Moved elasticM365 Identity Global Administrator Role Assigned elasticM365 Identity OAuth Flow by User Sign-in to Device Registration elasticM365 Identity OAuth Illicit Consent Grant by Rare Client and User elasticM365 SharePoint Site Administrator Added	9	47
`data_stream.dataset`	`eq`	`azure.signinlogs` elasticEntra ID ADRS Token Request by Microsoft Authentication Broker elasticEntra ID AiTM Phishing-Kit Chain Detected elasticEntra ID Microsoft Authentication Broker DRS Sign-In from Suspicious ASN elasticEntra ID OAuth PRT Issuance to Non-Managed Device Detected elasticEntra ID Service Principal Federated Credential Authentication by Unusual Client elasticEntra ID Sharepoint or OneDrive Accessed by Unusual Client elasticEntra ID User Sign-in with Unusual Non-Managed Device	7	36
`Effect`	`eq`	`allow` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy +7 more rules	22	26
`Provider_Name`	`eq`	`iam.amazonaws.com` elasticAWS EC2 Instance Interaction with IAM Service elasticAWS IAM AdministratorAccess Policy Attached to Group elasticAWS IAM AdministratorAccess Policy Attached to Role elasticAWS IAM AdministratorAccess Policy Attached to User elasticAWS IAM API Calls via Temporary Session Tokens elasticAWS IAM Assume Role Policy Update elasticAWS IAM Credentials Added to a Bedrock API Key Phantom User elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Customer-Managed Policy Attached to Role by Rare User elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Added for Root elasticAWS IAM Login Profile Added to User elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed +7 more rules	22	32
`Resource`	`eq`	`*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy +7 more rules	22	23
`sourcetype`	`eq`	`o365:management:activity` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 ApplicationImpersonation Role Assigned splunkO365 Elevated Mailbox Permission Assigned splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 Mailbox Folder Read Permission Assigned splunkO365 Mailbox Folder Read Permission Granted splunkO365 Mailbox Read Access Granted to Application splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials splunkO365 Service Principal Privilege Escalation +1 more rules	16	80
`sourcetype`	`eq`	`azure:monitor:aad` splunkAzure AD Admin Consent Bypassed by Service Principal splunkAzure AD Application Administrator Role Assigned splunkAzure AD FullAccessAsApp Permission Assigned splunkAzure AD Global Administrator Role Assigned splunkAzure AD New MFA Method Registered splunkAzure AD PIM Role Assigned splunkAzure AD PIM Role Assignment Activated splunkAzure AD Privileged Role Assigned splunkAzure AD Privileged Role Assigned to Service Principal splunkAzure AD Service Principal New Client Credentials splunkAzure AD Service Principal Owner Added splunkAzure AD Service Principal Privilege Escalation splunkAzure AD Tenant Wide Admin Consent Granted splunkAzure AD User Enabled And Password Reset splunkAzure AD User ImmutableId Attribute Updated	15	47
`aws::eventName`	`in`	`AttachGroupPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachRolePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`AttachUserPolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation with admin managed policy kustoAWSCloudTrail - Privilege escalation with AdministratorAccess managed policy kustoAWSCloudTrail - Privilege escalation with FullAccess managed policy	14	17
`aws::eventName`	`in`	`CreatePolicy` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`CreatePolicyVersion` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Created CRUD S3 policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD DynamoDB policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD KMS policy and then privilege escalation kustoAWSCloudTrail - Creation of CRUD Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Creation of new CRUD IAM policy and then privilege escalation kustoAWSCloudTrail - Creation of SSM policy and then privilege escalation	11	14
`aws::eventName`	`in`	`PutGroupPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutRolePolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`aws::eventName`	`in`	`PutUserPolicy` kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via CRUD DynamoDB policy kustoAWSCloudTrail - Privilege escalation via CRUD IAM policy kustoAWSCloudTrail - Privilege escalation via CRUD KMS policy kustoAWSCloudTrail - Privilege escalation via CRUD Lambda policy kustoAWSCloudTrail - Privilege escalation via CRUD S3 policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy kustoAWSCloudTrail - Privilege escalation via SSM policy	11	12
`security_result.action`	`eq`	`ALLOW` chronicleAWS IAM Activity By S3 Browser Utility chronicleAWS IAM Activity From EC2 Instance chronicleClient Secret Added to Entra ID Application chronicleEntra ID Add User Outside PIM chronicleEntra ID Add User To Admin Role chronicleEntra ID Recently Created User Assigned an Entra ID Role chronicleGCP Admin Privileged Roles Added To Service Accounts chronicleGCP IAM Organization Policy Updated Or Deleted chronicleGoogle Cloud Service Account Key Created or Uploaded chronicleO365 AD PowerShell App Login Subsequent Activity chronicleO365 Add User To Admin Role chronicleO365 Entra ID App Client Secret Added, Updated or Deleted chronicleO365 Recently Created Entra ID User Assigned Roles	13	102
`aws::eventSource`	`eq`	`iam.amazonaws.com` sigmaAWS IAM Backdoor Users Keys sigmaAWS User Login Profile Was Modified sigmaIAM Access Key Created sigmaIAM Access Key Creation Attempt sigmaIAM Admin Policy Attached sigmaIAM Login Profile Created sigmaIAM Policy Attachment Attempt splunkAWS IAM Failure Group Deletion splunkAWS IAM Successful Group Deletion pantherAWS User API Key Created pantherAWS User Login Profile Created or Modified pantherDEPRECATED - AWS User Login Profile Modified	12	28
`ServiceName`	`eq`	`k8s.io` elasticGKE Certificate Signing Request API Client Signer Requested elasticGKE Certificate Signing Request for Privileged Identity elasticGKE Certificate Signing Request Self-Approved elasticGKE Client Certificate Signing Request Created or Approved elasticGKE Cluster-Admin Role Binding Created or Modified elasticGKE Creation of a RoleBinding Referencing a ServiceAccount elasticGKE Creation or Modification of Sensitive Role elasticGKE RBAC Wildcard Elevation on Existing Role elasticGKE Sensitive RBAC Change Followed by Workload Modification elasticGKE Service Account Modified RBAC Objects elasticGKE Unusual Sensitive Workload Modification	11	37
`Action`	`contains`	`iam:*` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Action`	`contains`	`iam:passrole` kustoAWSCloudTrail - CloudFormation policy created then used for privilege escalation kustoAWSCloudTrail - Creation of DataPipeline policy and then privilege escalation kustoAWSCloudTrail - Creation of EC2 policy and then privilege escalation kustoAWSCloudTrail - Creation of Glue policy and then privilege escalation kustoAWSCloudTrail - Creation of Lambda policy and then privilege escalation kustoAWSCloudTrail - Privilege escalation via CloudFormation policy kustoAWSCloudTrail - Privilege escalation via DataPipeline policy kustoAWSCloudTrail - Privilege escalation via EC2 policy kustoAWSCloudTrail - Privilege escalation via Glue policy kustoAWSCloudTrail - Privilege escalation via Lambda policy	10	10
`Workload`	`eq`	`azureactivedirectory` splunkO365 Admin Consent Bypassed by Service Principal splunkO365 Application Available To Other Tenants splunkO365 Application Registration Owner Added splunkO365 FullAccessAsApp Permission Assigned splunkO365 High Privilege Role Granted splunkO365 New MFA Method Registered splunkO365 Privileged Role Assigned splunkO365 Privileged Role Assigned To Service Principal splunkO365 Service Principal New Client Credentials	9	30
`kubernetes.audit.annotations.authorization_k8s_io/decision`	`eq`	`allow` elasticEKS Authentication Configuration Modified elasticKubernetes Client Certificate Signing Request Created or Approved elasticKubernetes Cluster-Admin Role Binding Created elasticKubernetes Creation of a RoleBinding Referencing a ServiceAccount elasticKubernetes Creation or Modification of Sensitive Role elasticKubernetes RBAC Wildcard Elevation on Existing Role elasticKubernetes Sensitive RBAC Change Followed by Workload Modification elasticKubernetes Service Account Modified RBAC Objects elasticUnusual Kubernetes Sensitive Workload Modification	9	25
`metadata.log_type`	`eq`	`SAP_CHANGE_DOCUMENT` chroniclesap change documents sensitive profile assignment chroniclesap change documents sensitive profile assignment data table chroniclesap change documents sensitive role assignment chroniclesap critial role assigned to new user chroniclesap critical authorization value changed chroniclesap critical role assigned to new user chroniclesap sensitive role assignment correlation chroniclesap sensitive role authorization modification	8	8
`Category`	`eq`	`rolemanagement` kusto[Entra ID] Application Assigned Administrator Permissions Immediately After Obtaining Role Management Permissions kustoAdmin promotion after Role Management Application Permission Grant kustoDetect PIM Alert Disabling activity kustoNew External User Granted Admin Role kustoNRT User added to Microsoft Entra ID Privileged Groups kustoThreat Essentials - NRT User added to Microsoft Entra ID Privileged Groups kustoUser added to Microsoft Entra ID Privileged Groups	7	21
`OperationType`	`eq`	`%%14674` sigmaSuspicious modification of a fake domain controller SPN (DCshadow) (Directory Services) sigmaSuspicious modification of a user account SPN to enable Kerberoast attack elasticAccount Configured with Never-Expiring Password elasticAdminSDHolder SDProp Exclusion Added elasticModification of the msPKIAccountCredentials elasticUser account exposed to Kerberoasting splunkWindows AD ServicePrincipalName Added To Domain Account	7	17

Exclusions (255 distinct)

These values appear most often in top-level exclusions.

Field	Kind	Value	Rules excluding
`aws::userIdentity.type`	`eq`	`awsservice` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	5
`AllowedToDelegateTo`	`eq`	`-` sigmaActive Directory User Backdoors sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Any protocol sigmaHost constrained delegation settings changed for potential abuse (Rubeus) - Kerberos only sigmaHost set with constrained delegation	4
`SubjectUserSid`	`eq`	`s-1-5-18` sigmaHigh risk local/domain local group membership change sigmaMedium risk local/domain local group membership change sigmaPrivilege SeMachineAccountPrivilege abuse elasticModification of the msPKIAccountCredentials	4
`aws::sourceIPAddress`	`in`	`cloudformation.amazonaws.com` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::sourceIPAddress`	`in`	`servicecatalog.amazonaws.com` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::userAgent`	`contains`	`ansible` elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::userAgent`	`contains`	`pulumi` elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::userAgent`	`contains`	`terraform` elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permission Boundary or Guardrail Policy Deleted by Unusual Identity elasticAWS IAM Permissions Boundary Modified or Removed	4
`aws::userIdentity.arn`	`contains`	`terraform` elasticAWS EKS Access Entry Modified elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`responseStatus.code`	`ge`	`1` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`ge`	`400` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`responseStatus.code`	`le`	`16` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4
`source.as.organization.name`	`starts_with`	`AMAZON` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`source.as.organization.name`	`starts_with`	`Amazon` elasticAWS IAM Customer Managed Policy Version Created or Default Version Set elasticAWS IAM Inline Policy Added to a Group elasticAWS IAM Login Profile Created or Modified for an IAM User elasticAWS IAM Permissions Boundary Modified or Removed	4
`username`	`in`	`aksService` pantherKubernetes Client Certificate Credential Created pantherKubernetes ClusterRoleBinding to Privileged Role pantherKubernetes Long-Lived Service Account Token Created pantherKubernetes System Role Modified or Deleted	4

Account Manipulation `T1098`

Events covered

Authoring guide

Fields filtered most (464 distinct)

Top indicator values (2227 distinct)

Exclusions (255 distinct)

Rules under this technique

Sigma 100 rules

Elastic 174 rules

Splunk 70 rules

Kusto 131 rules

YARA-L 29 rules

Panther 83 rules

Account Manipulation T1098

Events covered

Authoring guide

Fields filtered most (464 distinct)

Top indicator values (2227 distinct)

Exclusions (255 distinct)

Rules under this technique

Sigma 100 rules

Elastic 174 rules

Splunk 70 rules

Kusto 131 rules

YARA-L 29 rules

Panther 83 rules

Account Manipulation `T1098`