Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups.(Citation: FireEye SMOKEDHAM June 2021) These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to bypass password duration policies and preserve the life of compromised credentials. 

In order to create or manipulate accounts, the adversary must already have sufficient permissions on systems or the domain. However, account manipulation may also lead to privilege escalation where modifications grant access to additional roles, permissions, or higher-privileged [Valid Accounts](https://attack.mitre.org/techniques/T1078).
Account Manipulation
source_name: mitre-attack  url: https://attack.mitre.org/techniques/T1098  external_id: T1098     source_name: FireEye SMOKEDHAM June 2021  description: FireEye. (2021, June 16). Smoking Out a DARKSIDE Affiliate’s Supply Chain Software Compromise. Retrieved September 22, 2021.  url: https://www.fireeye.com/blog/threat-research/2021/06/darkside-affiliate-supply-chain-software-compromise.html     source_name: Microsoft Security Event 4670  description: Franklin Smith, R. (n.d.). Windows Security Log Event ID 4670. Retrieved November 4, 2019.  url: https://www.ultimatewindowssecurity.com/securitylog/encyclopedia/event.aspx?eventID=4670     source_name: Microsoft User Modified Event  description: Lich, B., Miroshnikov, A. (2017, April 5). 4738(S): A user account was changed. Retrieved June 30, 2017.  url: https://docs.microsoft.com/en-us/windows/security/threat-protection/auditing/event-4738     source_name: InsiderThreat ChangeNTLM July 2017  description: Warren, J. (2017, July 11). Manipulating User Passwords with Mimikatz. Retrieved December 4, 2017.  url: https://blog.stealthbits.com/manipulating-user-passwords-with-mimikatz-SetNTLM-ChangeNTLM     source_name: GitHub Mimikatz Issue 92 June 2017  description: Warren, J. (2017, June 22). lsadump::changentlm and lsadump::setntlm work, but generate Windows events #92. Retrieved December 4, 2017.  url: https://github.com/gentilkiwi/mimikatz/issues/92     