ATT&CK Reference
Portfolio

TA0003 · PERSISTENCE

Account Manipulation

T1098Windows · IaaS · Linux · macOS · SaaS · Network Devices · Containers · Office Suite · Identity Provider · ESXiattack.mitre.org

Adding credentials to an existing account — SSH keys, app registrations, additional MFA devices.

Detect it with

New MFA method registered immediately after a suspicious sign-in; new service principal credentials in cloud audit logs.

Why it matters on shift

Account Manipulation is one of the concrete ways adversaries achieve persistence. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.

What to look for next

After persistence, the next tactic is usually Privilege Escalation. Search your telemetry for the transition before closing the ticket.

7 sub-techniques

How it shows up in practice

  1. T1098.001

    Additional Cloud Credentials

    Adversaries may add adversary-controlled credentials to a cloud account to maintain persistent access to victim accounts and instances within the environment.

  2. T1098.002

    Additional Email Delegate Permissions

    Adversaries may grant additional permission levels to maintain persistent access to an adversary-controlled email account.

  3. T1098.003

    Additional Cloud Roles

    An adversary may add additional roles or permissions to an adversary-controlled cloud account to maintain persistent access to a tenant.

  4. T1098.004

    SSH Authorized Keys

    Adversaries may modify the SSH authorized_keys file to maintain persistence on a victim host. Linux distributions, macOS, and ESXi hypervisors commonly use key-based authentication to secure the authentication process of SSH sessions for remote management.

  5. T1098.005

    Device Registration

    Adversaries may register a device to an adversary-controlled account.

  6. T1098.006

    Additional Container Cluster Roles

    An adversary may add additional roles or permissions to an adversary-controlled user or service account to maintain persistent access to a container orchestration system.

  7. T1098.007

    Additional Local or Domain Groups

    An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.

Kill-chain context

← beforeExecutionPersistenceafter →Privilege Escalation