Threadlinqs IntelligenceStart free

ATT&CK techniquePersistencePrivilege Escalation

T1098 Account Manipulation

PersistencePrivilege EscalationEnterprise

As of 2026-10-05, T1098 (Account Manipulation) appears in 288 tracked threats, first reported 2025-10-13 and most recently 2026-10-02, with linked actors including Scattered Spider, ShinyHunters, TeamPCP; it most often appears alongside T1078 (Valid Accounts).

Tracked threats
288144 critical, 126 high, 14 medium, 1 low
First seen
2025-10-13
Last seen
2026-10-02
Threat actors
91In the threats using it
Detection rules
343Blue tier and above

Data as of:

Activity timeline

T1098 first appeared in tracked threats on and was most recently reported on . The busiest month was 2026-07 with 91 reports, and 287 of the 288 threats were reported in the twelve months to 2026-10.

How adversaries use it

T1098 Account Manipulation is catalogued by MITRE ATT&CK under the Persistence and Privilege Escalation tactics in the Enterprise matrix. Threadlinqs maps 288 of 2623 tracked threats (11%) to it; by severity that is 144 critical, 126 high, 14 medium, 1 low.

Threats that use T1098 most often also use T1078 Valid Accounts (182 threats), T1190 Exploit Public-Facing Application (174 threats), T1059 Command and Scripting Interpreter (151 threats), T1552 Unsecured Credentials (129 threats), T1005 Data from Local System (126 threats). These are the techniques an intrusion set tends to chain with it, so they are the natural next places to look when it is observed.

91 tracked threat actors appear in the threats that use T1098; the most frequent are Scattered Spider (8), ShinyHunters (8), TeamPCP (8), Static Tundra (6), The Com (6).

Mitigations

MITRE ATT&CK lists 7 mitigations for T1098.

Data sources

Telemetry that can reveal T1098, per MITRE ATT&CK.

  • Active Directory — Active Directory Object Modification
  • Command — Command Execution
  • File — File Modification
  • Group — Group Modification
  • Process — Process Creation
  • User Account — User Account Modification

Threat actors using it

Tracked threats

The 30 most recent of 288 tracked threats that use T1098.

Detection coverage

Threadlinqs maintains 343 detection rules mapped to T1098 (SPL 120, KQL 107, Sigma 116). Rule content is available to Blue tier accounts and above; this page shows counts only.

343 detection rules (SPL/KQL/Sigma) · Blue and above. Compare plans

Sub-techniques