skills.rest
xalgord
xalgordCOMMUNITY
Explore all skills by this author →
WebsiteGitHub

hunting-for-t1098-account-manipulation

Detect MITRE ATT&CK T1098 account manipulation using Windows Security Event Logs.

954|172|Updated Mar 13, 2026
Search Tags:#detection#threat hunting#mitre attack#windows event logs#Active Directory#account manipulation#t1098
One-click install
npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-t1098-account-manipulation
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: hunting-for-t1098-account-manipulation
Source: https://github.com/xalgord/xalgorix/tree/main/internal/tools/skills/data/threat-hunting/hunting-for-t1098-account-manipulation
Command: npx skills add https://github.com/xalgord/xalgorix --skill hunting-for-t1098-account-manipulation

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires python-evtx, lxml.

What problem does it solve?

SOC analysts and threat hunters need a structured way to detect adversaries who maintain or expand access by manipulating Active Directory accounts, such as creating shadow admins, injecting SID history, or modifying privileged group memberships, which often evade default monitoring coverage.

Core Features & Use Cases

  • Event Log Analysis: Parses Windows Security Event IDs 4738, 4728, 4732, 4756, 5136, and 4670 to surface account modification activity.
  • Shadow Admin Detection: Identifies AdminSDHolder abuse, direct privilege assignment, SID history injection, and shadow credentials written to msDS-KeyCredentialLink.
  • Timeline Correlation: Cross-references account changes with authentication events to link initial compromise to persistence establishment.
  • Use Case: During an incident investigation, a SOC analyst runs this hunt against domain controller EVTX logs to confirm whether an attacker added a compromised account to Domain Admins and reset passwords to maintain persistence.

Quick Start

Hunt for T1098 account manipulation in the provided Windows Security Event Logs and produce a JSON report of privileged group changes and shadow admin indicators.

Frequently Asked Questions about hunting-for-t1098-account-manipulation

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I detect T1098 account manipulation in Windows event logs?▼

Monitor Windows Security Event IDs 4738 (account changed), 4728/4732/4756 (member added to privileged groups), and 5136 (directory object modified). Flag additions to Domain Admins, Enterprise Admins, and Administrators groups, then correlate with authentication events.

What Windows Event IDs indicate shadow admin or persistence activity?▼

Key indicators include 4780 for AdminSDHolder ACL application, 4765/4766 for SID history injection, and 5136 attribute changes for shadow credentials written to msDS-KeyCredentialLink. These stealth variants raise no standard group-add events.

Why am I missing account manipulation events in my SIEM?▼

Missing subcategories like Audit User Account Management, Audit Security Group Management, or DS-access SACLs (off by default for 5136) create blind spots. Also, group and credential events log on the domain controller that processed them, not member servers.

What tools are needed to parse Windows Security Event Logs for threat hunting?▼

This workflow requires Python 3.9+ with the python-evtx and lxml libraries to parse EVTX files, or direct SIEM access. Familiarity with Active Directory group structure and SID architecture is also needed.

How do I validate detection coverage for account manipulation attacks?▼

Run Atomic Red Team tests for T1098, such as adding a user to Administrators and resetting a password, then confirm events 4728 and 4724 fire on the domain controller. Baseline IDM and helpdesk service accounts to reduce false positives.

Related Skills

Explore More Software Engineering Skills→
SherifEldeebSherifEldeeb
5

log-forensics

Correlate Windows Event Logs, Syslog, and web logs to construct forensic timelines.

Community
Advanced
dandyedandye
120

respond-compromised-account

Coordinate PICERL-based incident response to detect, contain, eradicate, and recover compromised accounts.

Community
Advanced
jmaglyjmagly
175

log-analysis

Correlate authentication, system, application, and web server logs to detect attacker activity patterns.

Community
Advanced
briiirussellbriiirussell
345

threat-hunting

Conduct hypothesis-driven threat hunts in SIEM/EDR logs using PEAK workflows.

Community
Advanced