Techniques › T1098 › T1098.007
T1098.007 Additional Local or Domain Groups
persistence · privilege escalation — Windows, macOS, Linux · attack.mitre.org · JSON
1
MITRE detection strategy
3
analytics
0
Sigma rules tagged attack.t1098.007
0
KEV CVEs mapped here
<p>An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.</p><p>On Windows, accounts may use the
net localgroup and net group commands to add existing users to local and domain groups. On Linux, adversaries may use the usermod command for the same purpose.</p><p>For example, accounts may be added to the local administrators group on Windows devices to maintain elevated privileges. They may also be added to the Remote Desktop Users group, which allows them to leverage Remote Desktop Protocol to log into the endpoints in the future. Adversaries may also add accounts to VPN user groups to gain future persistence on the network. On Linux, accounts may be added to the sudoers group, allowing them to persistently leverage Sudo and Sudo Caching for elevated privileges.</p><p>In Windows environments, machine accounts may also be added to domain groups. This allows the local SYSTEM account to gain privileges on the domain.</p>KEV CVEs mapped to this technique · CTID Mappings Explorer
None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.
Detection strategy · ATT&CK Enterprise v19.2
- DET0310 Suspicious Addition to Local or Domain Groups v1.0
AN0865 WindowsDetects unauthorized additions of users or machine accounts to privileged local or domain groups (e.g., Administrators, Remote Desktop Users).WinEventLog:Security
EventCode=4728, 4729, 4732, 4733, 4756, 4757→ DC0010 User Account ModificationTunable:TargetGroupTimeWindowUserContextAN0866 LinuxDetects unexpected use of usermod, gpasswd, or direct modification of /etc/group to elevate user group membership.auditd:SYSCALLSYSCALL for usermod or /etc/group file modification→ DC0010 User Account ModificationTunable:GroupNameUserContextTimeWindowAN0867 macOSDetects use ofdseditgroupordsclto add users to privileged macOS groups (e.g., admin).Tunable:GroupNameUserContextTimeWindow
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1098.007
No Sigma rule carries this tag. MITRE publishes a detection strategy above, so the behaviour is specified; what is missing is public detection content.
Rules tagged at the parent level (attack.t1098) 34
These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 02122374-b74e-495c-b285-9e4da973f3d6
Detects the creation of a dMSA service account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Thomas Patzke
· 2019-12-03 (modified 2024-01-16) · logsource: product=windows service=security · 0255a820-e564-4e40-af2b-6ac61160335c
Addition of domains is seldom and should be verified for legitimacy.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · 02c39d30-02b5-45d2-b435-8aebfe5a8629
Detects activity when a member is removed from a security-enabled global group
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 04e2a23a-9b29-4a5c-be3a-3542e3f982ba
Detects when an API access service account is granted domain authority.
Author: toffeebr33k
· 2021-08-09 (modified 2024-04-26) · logsource: product=aws service=cloudtrail · 055fb148-60f8-462d-ad16-26926ce050f1
Detects activity when someone is changing passwords on behalf of other users.
An attacker with the "iam:UpdateLoginProfile" permission on other users can change the password used to login to the AWS console on any user that already has a login profile setup.
Author: faloker
· 2020-02-12 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 0a5177f4-6ca9-44c2-aacf-d3f3d8b6e4d2
Detects AWS API key creation for a user by another user.
Backdoored users can be used to obtain persistence in the AWS environment.
Also with this alert, you can detect a flow of AWS keys in your org.
Author: Pawel Mazur
· 2022-12-21 (modified 2025-01-21) · logsource: product=linux · 0ac15ec3-d24f-4246-aa2a-3077bb1cf90e
Detects the addition of a new user to a privileged group such as "root" or "sudo"
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=process_creation · 0ea8db81-2ff6-4525-9448-33bbe7effc13
Detects the creation of a dMSASvc account using the New-ADServiceAccount cmdlet in certain OUs.
The fact that the Cmdlet is used to create a dMSASvc account in a specific OU is highly suspicious.
It is a pattern trying to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
On top of that, if the user that is creating the dMSASvc account is not a legitimate administrator or does not have the necessary permissions,
it is a strong signal of an attempted or successful abuse of the BaDSuccessor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Mark Morowczynski '@markmorow', Yochana Henderson, '@Yochana-H'
· 2022-08-05 · logsource: product=azure service=auditlogs · 102e11e3-2db5-4c9e-bc26-357d42585d21
Detects when a user is removed from a privileged role. Bulk changes should be investigated.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2024-02-23 · logsource: product=windows category=process_creation · 10fb649c-3600-4d37-b1e6-56ea90bb7e09
Detects addition of users to highly privileged groups via "Net" or "Add-LocalGroupMember".
Author: Mark Morowczynski '@markmorow', Gloria Lee, '@gleeiamglo'
· 2023-09-03 · logsource: product=azure service=riskdetection · 258b6593-215d-4a26-a141-c8e31c1299a6
Indicates that there are anomalous patterns of behavior like suspicious changes to the directory.
Author: Samir Bousseaden, Roberto Rodriguez @Cyb3rWard0g, oscd.community, Tim Shelton, Maxence Fossat
· 2019-04-03 (modified 2022-08-16) · logsource: product=windows service=security · 2c99737c-585d-4431-b61a-c911d86ff32f
Backdooring domain object to grant the rights associated with DCSync to a regular user or machine account using Powerview\Add-DomainObjectAcl DCSync Extended Right cmdlet, will allow to re-obtain the pwd hashes of any user/computer
Author: Austin Songer
· 2021-08-23 (modified 2023-10-11) · logsource: product=gcp service=google_workspace.admin · 2d1b83e4-17c6-4896-a37b-29140b40a788
Detects when an Google Workspace user is granted admin privileges.
Author: @neu5ron
· 2017-04-13 (modified 2024-02-26) · logsource: product=windows service=security · 300bac00-e041-4ee2-9c36-e262656a6ecc
Detects scenarios where one can control another users or computers account without having to use their credentials.
Author: @neu5ron
· 2017-07-30 (modified 2021-12-02) · logsource: product=windows service=security · 311b6ce2-7890-4383-a8c2-663a9f6b43cd
Detects scenario where if a user is assigned the SeEnableDelegationPrivilege right in Active Directory it would allow control of other AD user objects.
Author: Bryan Lim
· 2024-01-12 · logsource: product=gcp service=gcp.audit · 32438676-1dba-4ac7-bf69-b86cba995e05
Detects when an access policy that is applied to a GCP cloud resource is deleted.
An adversary would be able to remove access policies to gain access to a GCP cloud resource.
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · 3940b5f1-3f46-44aa-b746-ebe615b879e0
Detects when a transfer lock was removed from a Route 53 domain. It is recommended to refrain from performing this action unless intending to transfer the domain to a different registrar.
Author: Florian Roth (Nextron Systems)
· 2021-12-22 (modified 2022-12-25) · logsource: product=windows service=security · 45eb2ae2-9aa2-4c3a-99a5-6e5077655466
Detects the renaming of an existing computer account to a account name that doesn't contain a $ symbol as seen in attacks against CVE-2021-42287
Author: AlertIQ
· 2021-10-10 (modified 2022-12-25) · logsource: product=azure service=auditlogs · 4d78a000-ab52-4564-88a5-7ab5242b20c7
Change to authentication method could be an indicator of an attacker adding an auth method to the account so they can have continued access.
Author: frack113
· 2021-12-28 · logsource: product=windows category=ps_script · 4fdc44df-bfe9-4fcc-b041-68f5a2d3031c
Adversaries may manipulate accounts to maintain access to victim systems.
Account manipulation may consist of any action that preserves adversary access to a compromised account, such as modifying credentials or permission groups
Author: Thomas Patzke
· 2017-02-19 (modified 2020-08-23) · logsource: product=windows service=security · 53ad8e36-f573-46bf-97e4-15ba5bf4bb51
Detects potential attempts made to set the Directory Services Restore Mode administrator password.
The Directory Service Restore Mode (DSRM) account is a local administrator account on Domain Controllers.
Attackers may change the password in order to obtain persistence.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · 6c9eb492-e477-4df9-b0f4-571fc9db29cd
Detects modifications to the msDS-ManagedAccountPrecededByLink attribute, which may indicate an attempted or successful abuse of the BaD-Successor msDS-DelegatedManagedServiceAccount (DMSA) vulnerability.
The DMSA is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Changes to this attribute by suspicious accounts or outside of normal administrative workflows are a strong signal of an attempted or successful abuse.
If it is indeed modified by an account that is not typically responsible for such changes, it could indicate an attempt to exploit the BaD-Successor vulnerability for privilege escalation within the Windows Server 2025 Active Directory environment.
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 6d844f0f-1c18-41af-8f19-33e7654edfc3
Find local accounts being created or modified as well as remote authentication configurations
Author: Daniel Koifman (KoifSec)
· 2025-07-30 · logsource: product=windows category=process_creation · 7864a175-3654-4824-9f0d-f0da18ab27c0
Detects the use of wmic.exe to modify user account settings and explicitly disable password expiration.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2023-09-04 · logsource: product=linux category=process_creation · 9691f58d-92c1-4416-8bf3-2edd753ec9cf
Detects execution of the "esxcli" command with the "system" and "permission" flags in order to assign admin permissions to an account.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows category=ps_script · 9b111d8e-92e0-4153-88bc-daefc1333aba
Detects modification of dMSA link attributes (msDS-ManagedAccountPrecededByLink) via PowerShell scripts.
This command line pattern could be an indicator an attempt to exploit the BadSuccessor privilege escalation vulnerability in Windows Server 2025.
Author: Muhammad Faisal (@faisalusuf)
· 2024-02-25 · logsource: product=bitbucket service=audit · aac6c4f4-87c7-4961-96ac-c3fd3a42c310
Detects global permissions change activity.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems)
· 2022-08-12 (modified 2023-03-02) · logsource: product=windows category=process_creation · ad720b90-25ad-43ff-9b5e-5c841facc8e5
Detects addition of users to the local administrator group via "Net" or "Add-LocalGroupMember".
Author: Elastic, Austin Songer @austinsonger
· 2021-07-22 (modified 2022-10-09) · logsource: product=aws service=cloudtrail · b056de1a-6e6e-4e40-a67e-97c9808cf41b
Detects when a request has been made to transfer a Route 53 domain to another AWS account.
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · b237c54b-0f15-4612-a819-44b735e0de27
Detects activity when a security-enabled global group is deleted
Author: Florian Roth (Nextron Systems)
· 2017-03-14 (modified 2021-01-17) · logsource: product=windows service=security · c265cf08-3f99-46c1-8d59-328247057d57
Detects the addition of a new member to the local administrator group, which could be legitimate activity or a sign of privilege escalation activity
Author: Alexandr Yampolskyi, SOC Prime
· 2023-04-26 · logsource: product=windows service=security · c43c26be-2e87-46c7-8661-284588c5a53e
Detects activity when a member is added to a security-enabled global group
Author: sawwinnnaung
· 2020-05-07 (modified 2023-10-11) · logsource: product=azure service=activitylogs · d2d901db-7a75-45a1-bc39-0cbf00812192
Number of VM creations or deployment activities occur in Azure via the azureactivity log.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-05-24 · logsource: product=windows service=security · e15bc294-ae2a-45ad-b7d6-637b33868bde
Detects the creation of new msDS-DelegatedManagedServiceAccount objects, which could indicate potential abuse of privilege escalation vulnerabilities in Windows Server 2025.
The msDS-DelegatedManagedServiceAccount (DMSA) is a new object class introduced in Windows Server 2025 that allows administrators to delegate the management of service accounts to other users or groups.
Attackers may exploit this feature to create unauthorized service accounts with elevated privileges, leading to privilege escalation within the Active Directory environment.
It is highly suspicious if an msDS-DelegatedManagedServiceAccount object is created without proper authorization or in an unexpected context, such as by a non-administrative user or outside of normal administrative workflows.
So, it's a good idea to look out for accounts that are not typically responsible for service account creation to detect potential abuse of this feature.