Skip to content

Account Manipulation

Technique · ATTACK:enterprise:T1098

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1098",
  "title": "Account Manipulation",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1098",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--a10641f4-87b4-45a3-a906-92a149cb2c27",
  "external_id": "T1098",
  "domain": "enterprise",
  "created": "2017-05-31T21:31:12.196Z",
  "modified": "2026-05-12T15:12:00.706Z",
  "version": "2.8",
  "aliases": [

  ],
  "tactics": [
    "persistence",
    "privilege-escalation"
  ],
  "source_references": [
    {
      "source_name": "FireEye SMOKEDHAM June 2021",
      "url": "https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html"
    },
    {
      "source_name": "Microsoft Security Event 4670",
      "url": "https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670"
    },
    {
      "source_name": "Microsoft User Modified Event",
      "url": "https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738"
    },
    {
      "source_name": "InsiderThreat ChangeNTLM July 2017",
      "url": "https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM"
    },
    {
      "source_name": "GitHub Mimikatz Issue 92 June 2017",
      "url": "https://github.com/gentilkiwi/mimikatz/issues/92"
    }
  ]
}

Explicit source assertions (24)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:M1030 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--21ea4371-e692-4731-9f8c-c3f4dff3c775

ATTACK:enterprise:G0032 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2325c0b2-fb89-44e1-9206-e495811f2907

Novetta Blockbuster Destructive Malware · Novetta Blockbuster

ATTACK:enterprise:G1059 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2e451e48-c991-440d-b83c-320f709ceebd

Mandiant_UNC1549TTPsTools_Nov2025

ATTACK:enterprise:T1098.001 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--32d35bd7-e09b-4e92-b560-4adb1bac59d5

ATTACK:enterprise:M1042 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--45e8c03d-86f3-4cc0-907b-1e1d13960e43

ATTACK:enterprise:G1056 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--547d1be4-fc73-45e5-a7ff-0588e8bd050c

Aqua Security Blog Trivy Compromise APR 2026

ATTACK:enterprise:M1018 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--64628ae8-0bc8-428c-b7e5-1d738bc55e78

ATTACK:enterprise:S0002 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e641c36-188b-480e-b177-e412cd000b34

Adsecurity Mimikatz Guide · Metcalf 2015

ATTACK:enterprise:T1098.002 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6e743193-6a74-422a-bdea-c0d4abbf9ad9

ATTACK:enterprise:M1022 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6fd6a4ce-d14c-48ed-88c5-3997e67e0fd6

ATTACK:enterprise:M1032 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--74e433ec-0c52-42f2-b0d4-3e1f3a56b419

ATTACK:enterprise:T1098.003 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7cb81e24-b3b8-4a56-b153-3247193de120

ATTACK:enterprise:T1098.005 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--81a6a1c2-a834-47ed-ba5e-3048c62115ff

ATTACK:enterprise:T1098.006 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--82e47c11-6480-4c0b-abd2-48868b9aecd4

ATTACK:enterprise:T1098.004 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b86fa49-6d13-42b4-bd48-814abfd6793f

ATTACK:enterprise:S9008 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--98aa284c-7c8b-4577-9aed-5eaee1f1c787

Aikido Shai-Hulud September 2025 · Netskope Shai-Hulud November 2025 · Wiz Shai-Hulud September 2025 · Microsoft Shai-Hulud December 2025

ATTACK:enterprise:M1026 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--9ffc8525-79a5-40a2-b371-46052daf66c5

ATTACK:enterprise:G1015 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--b7e52798-0764-4e01-b18a-81ec0d30c36f

Mandiant VMware vSphere JUL 2025

ATTACK:enterprise:C0025 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c23d5ed2-f358-41d7-99c3-658f4d584786

Dragos Crashoverride 2018

ATTACK:enterprise:G1055 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c4338a92-0adc-4d7e-a1ff-ab3cc321d914

Domain Tools Handala Hack Karma Homeland Justice MOIS April 2026 · SEC 8K Palo Alto Statement Stryker Corp Handala March 2026

ATTACK:enterprise:T1098.007 → subtechnique-of → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d226c16d-ffb6-4a47-a5f1-7e1183b6c030

ATTACK:enterprise:G0125 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d2edfaee-154b-4566-b85c-740e591477d9

Volexity Exchange Marauder March 2021 · Microsoft Silk Typhoon MAR 2025

ATTACK:enterprise:S0274 → uses → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--fe56443a-5f0b-4120-9d27-d4d98aae69b8

Symantec Calisto July 2018

ATTACK:enterprise:M1028 → mitigates → ATTACK:enterprise:T1098

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ff7f776f-001a-4c86-b359-08c89bd08b3e

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.