attack.t1098

Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.

Add User to Local Administrators Group

Mar 2, 2023 · attack.persistence attack.t1098 ·

Share on:

Detects suspicious command line that adds an account to the local administrators/administrateurs group

User Added to Local Administrators

Feb 27, 2023 · attack.privilege_escalation attack.t1078 attack.persistence attack.t1098 ·

Share on:

This rule triggers on user accounts that are added to the local Administrators group, which could be legitimate activity or a sign of privilege escalation activity

Change to Authentication Method

Jan 29, 2023 · attack.credential_access attack.t1556 attack.persistence attack.defense_evasion attack.t1098 ·

Share on:

Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.

Powershell LocalAccount Manipulation

Jan 27, 2023 · attack.persistence attack.t1098 ·

Share on:

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups

Number Of Resource Creation Or Deployment Activities

Jan 9, 2023 · attack.persistence attack.t1098 ·

Share on:

Number of VM creations or deployment activities occur in Azure via the azureactivity log.

Cisco Local Accounts

Jan 4, 2023 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Find local accounts being created or modified as well as remote authentication configurations

Privileged User Has Been Created

Dec 21, 2022 · attack.persistence attack.t1136.001 attack.t1098 ·

Share on:

Detects the addition of a new user to a privileged group such as "root" or "sudo"

Powerview Add-DomainObjectAcl DCSync AD Extend Right

Oct 25, 2022 · attack.persistence attack.t1098 ·

Share on:

Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer

AWS IAM Backdoor Users Keys

Oct 25, 2022 · attack.persistence attack.t1098 ·

Share on:

Detects AWS API key creation for a user by another user. Backdoored users can be used to obtain persistence in the AWS environment. Also with this alert, you can detect a flow of AWS keys in your org.

AWS User Login Profile Was Modified

Oct 25, 2022 · attack.persistence attack.t1098 ·

Share on:

An attacker with the iam:UpdateLoginProfile permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup. With this alert, it is used to detect anyone is changing password on behalf of other users.

Bulk Deletion Changes To Privileged Account Permissions

Oct 25, 2022 · attack.persistence attack.t1098 ·

Share on:

Detects when a user is removed from a privileged role. Bulk changes should be investigated.

Addition of Domain Trusts

Oct 14, 2022 · attack.persistence attack.t1098 ·

Share on:

Addition of domains is seldom and should be verified for legitimacy.

Password Change on Directory Service Restore Mode (DSRM) Account

Oct 14, 2022 · attack.persistence attack.t1098 ·

Share on:

The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers. Attackers may change the password to gain persistence.

AWS Route 53 Domain Transfer Lock Disabled

Oct 9, 2022 · attack.persistence attack.credential_access attack.t1098 ·

Share on:

Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.

AWS Route 53 Domain Transferred to Another Account

Oct 9, 2022 · attack.persistence attack.credential_access attack.t1098 ·

Share on:

Detects when a request has been made to transfer a Route 53 domain to another AWS account.

Anomalous User Activity

A Member Was Added to a Security-Enabled Global Group

A Member Was Removed From a Security-Enabled Global Group

A Security-Enabled Global Group Was Deleted

Suspicious Computer Account Name Change CVE-2021-42287

Enabled User Right in AD to Control User Objects

Add User to Local Administrators Group

User Added to Local Administrators

Change to Authentication Method

Powershell LocalAccount Manipulation

Number Of Resource Creation Or Deployment Activities

Cisco Local Accounts

Privileged User Has Been Created

Powerview Add-DomainObjectAcl DCSync AD Extend Right

AWS IAM Backdoor Users Keys

AWS User Login Profile Was Modified

Bulk Deletion Changes To Privileged Account Permissions

Addition of Domain Trusts

Password Change on Directory Service Restore Mode (DSRM) Account

AWS Route 53 Domain Transfer Lock Disabled

AWS Route 53 Domain Transferred to Another Account

Google Workspace Granted Domain API Access

Google Workspace User Granted Admin Privileges