Hunting for T1098 Account Manipulation
FreeDetect and analyze account manipulation in Active Directory.
Free · Opens the source repo
What Hunting for T1098 Account Manipulation does
The Hunting for T1098 Account Manipulation skill is designed for cybersecurity professionals who need to identify and respond to account manipulation activities within Active Directory environments. This skill leverages the MITRE ATT&CK framework, specifically focusing on the T1098 technique, which encompasses methods adversaries use to maintain or expand access to compromised accounts. By analyzing specific Windows Security Event Log IDs, the skill helps detect actions such as shadow admin creation, SID history injection, and unauthorized group membership changes.
The skill operates by parsing Windows Security Event Logs, particularly looking for Event IDs 4738, 4728, 4732, 4756, 4670, and 5136. It flags significant changes, such as additions to privileged groups like Domain Admins or Enterprise Admins, and identifies indicators of shadow admin accounts. This structured approach not only aids in incident response but also assists in building detection rules and threat hunting queries tailored to account manipulation techniques.
Ideal for security operations center (SOC) analysts and incident responders, this skill provides a systematic methodology for investigating suspected privilege persistence. It allows users to correlate account changes with authentication events, establishing a timeline that can reveal the initial compromise and subsequent persistence measures taken by adversaries. The output is a JSON report detailing detected account manipulation events, which can be integrated into broader security monitoring frameworks.
Overall, this skill is an essential tool for organizations looking to enhance their security posture against account manipulation threats, ensuring that they can quickly identify and mitigate potential risks in their Active Directory environments.
When to use it
Use this skill when investigating security incidents involving account manipulation, or when building detection rules for related attack techniques.
When not to use it
This skill may not be suitable for environments that do not utilize Active Directory or where Windows Security Event Logs are not available.
What you can build with it
Incident Response Investigation
Use this skill to investigate suspected account manipulation during a security incident, helping to identify unauthorized changes.
Building Detection Rules
Leverage the skill to create detection rules for monitoring account manipulation techniques in your security operations.
Validating Security Coverage
Employ this skill to assess and validate the effectiveness of your security monitoring coverage against account manipulation threats.
How to install Hunting for T1098 Account Manipulation
View source1. Install with the skills CLI
npx skills add mukul975/anthropic-cybersecurity-skills/hunting-for-t1098-account-manipulation --agent claude-code2. Or install it manually
Download the skill folder and drop it into ~/.claude/skills/ for all projects, or .claude/skills/ to scope it to one repo. Restart Claude Code so it picks up the new skill.
Anthropic's agentic coding CLI, and the reference implementation of Agent Skills. Drop a skill folder into ~/.claude/skills and Claude Code loads it automatically whenever a task matches the skill's description. Claude Code docs
Inside SKILL.md
Written by mukul975Hunting for T1098 Account Manipulation
Overview
MITRE ATT&CK T1098 (Account Manipulation) covers adversary actions to maintain or expand access to compromised accounts, including adding credentials, modifying group memberships, SID history injection, and creating shadow admin accounts. This skill covers detecting these techniques through Windows Security Event Log analysis (Event IDs 4738, 4728, 4732, 4756, 4670, 5136), correlating group membership changes with privilege escalation indicators, and identifying anomalous account modification patterns.
When to Use
- When investigating security incidents that require hunting for t1098 account manipulation
- When building detection rules or threat hunting queries for this domain
- When SOC analysts need structured procedures for this analysis type
- When validating security monitoring coverage for related attack techniques
Prerequisites
- Windows Security Event Logs (EVTX format) or SIEM access
- Python 3.9+ with
python-evtx,lxmllibraries - Understanding of Active Directory group structure and SID architecture
- Familiarity with MITRE ATT&CK T1098 sub-techniques
Steps
Step 1: Parse Account Modification Events
Extract Event IDs 4738 (user account changed), 4728/4732/4756 (member added to security groups), and 5136 (directory service object modified).
Step 2: Detect Privileged Group Changes
Flag additions to Domain Admins, Enterprise Admins, Schema Admins, Administrators, and Backup Operators groups.
Step 3: Identify Shadow Admin Indicators
Detect accounts receiving AdminSDHolder protection, direct privilege assignment, or SID history injection.
Step 4: Correlate with Attack Timeline
Cross-reference account changes with authentication events to identify initial compromise and persistence establishment.
Expected Output
JSON report with detected account manipulation events, privileged group changes, shadow admin indicators, and timeline correlation.
Frequently asked questions about Hunting for T1098 Account Manipulation
Similar skills
Asset Criticality Scoring for Vulns
Prioritize vulnerabilities based on asset criticality.
Performing Alert Triage with Elastic SIEM
Streamline alert triage processes in Elastic Security.
Active Directory Vulnerability Assessment
Secure your Active Directory with comprehensive assessments.
Active Directory Investigation
Streamline your Active Directory compromise investigations.
Parsing Artifacts with Eric Zimmerman Tools
Efficiently parse Windows forensic artifacts for analysis.
Operationalizing MISP Threat Feeds
Enhance threat detection with curated MISP feeds.