MITRE ATT&CK - Техника Манипуляции с учетной записью

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Манипуляции с учетной записью

Sub-techniques (5)

ID	Name
.001	Дополнительные облачные учетные данные
.002	Выдача доп. прав учетной записи эл. почты Exchange
.003	Добавление роли глобального администратора Office 365
.004	Изменение авторизованных SSH-ключей
.005	Регистрация устройства

Adversaries may manipulate accounts to maintain access to victim systems. Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts.

ID: T1098

Суб-техники: .001 .002 .003 .004 .005

Тактика(-и): Persistence

Платформы: Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows

Источники данных: Active Directory: Active Directory Object Modification, Command: Command Execution, File: File Modification, Group: Group Modification, Process: Process Creation, User Account: User Account Modification

Версия: 2.4

Дата создания: 31 May 2017

Последнее изменение: 18 Oct 2022

Название	Описание
Примеры процедур
Lazarus Group	Lazarus Group malware WhiskeyDelta-Two contains a function that attempts to rename the administrator’s account.(Citation: Novetta Blockbuster)(Citation: Novetta Blockbuster Destructive Malware)
SMOKEDHAM	SMOKEDHAM has added created user accounts to local Admin groups.(Citation: FireEye SMOKEDHAM June 2021)
Dragonfly 2.0	Dragonfly 2.0 added newly created accounts to the administrators group to maintain elevated access.(Citation: US-CERT TA18-074A)(Citation: US-CERT APT Energy Oct 2017)
APT3	APT3 has been known to add created accounts to local admin groups to maintain elevated access.(Citation: aptsim)
Mimikatz	The Mimikatz credential dumper has been extended to include Skeleton Key domain controller authentication bypass functionality. The `LSADUMP::ChangeNTLM` and `LSADUMP::SetNTLM` modules can also manipulate the password hash of an account without knowing the clear text value.(Citation: Adsecurity Mimikatz Guide)(Citation: Metcalf 2015)
Dragonfly	Dragonfly has added newly created accounts to the administrators group to maintain elevated access.(Citation: US-CERT TA18-074A)
Sandworm Team	Sandworm Team used the `sp_addlinkedsrvlogin` command in MS-SQL to create a link between a created account and other servers in the network.(Citation: Dragos Crashoverride 2018)
Kimsuky	Kimsuky has added accounts to specific groups with `net localgroup`.(Citation: KISA Operation Muzabi)
Calisto	Calisto adds permissions and remote logins to all users.(Citation: Symantec Calisto July 2018)

Контрмера	Описание
Контрмеры
Network Segmentation	Architect sections of the network to isolate critical systems, functions, or resources. Use physical and logical segmentation to prevent access to potentially sensitive systems and information. Use a DMZ to contain any internet-facing services that should not be exposed from the internal network. Configure separate virtual private cloud (VPC) instances to isolate critical cloud systems.
User Account Management	Manage the creation, modification, use, and permissions associated to user accounts.
Multi-factor Authentication	Use two or more pieces of evidence to authenticate to a system; such as username and password in addition to a token from a physical smart card or token generator.
Privileged Account Management	Manage the creation, modification, use, and permissions associated to privileged accounts, including SYSTEM and root.
Operating System Configuration	Make configuration changes related to the operating system or a common feature of the operating system that result in system hardening against techniques.

Обнаружение

Collect events that correlate with changes to account objects and/or permissions on systems and the domain, such as event IDs 4738, 4728 and 4670.(Citation: Microsoft User Modified Event)(Citation: Microsoft Security Event 4670)(Citation: Microsoft Security Event 4670) Monitor for modification of accounts in correlation with other suspicious activity. Changes may occur at unusual times or from unusual systems. Especially flag events where the subject and target accounts differ(Citation: InsiderThreat ChangeNTLM July 2017) or that include additional flags such as changing a password without knowledge of the old password.(Citation: GitHub Mimikatz Issue 92 June 2017) Monitor for use of credentials at unusual times or to unusual systems or services. This may also correlate with other suspicious activity. Monitor for unusual permissions changes that may indicate excessively broad permissions being granted to compromised accounts. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged Valid Accounts

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.