T1098PersistencePrivilege Escalation
Account Manipulation
Adversaries may manipulate accounts to maintain and/or elevate access to victim systems. Account manipulation may consist of any action that preserves or modifies adversary access to a compromised account, such as modifying credentials or permission groups. These actions could also include account activity designed to subvert security policies, such as performing iterative password updates to…
CVEs19
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.11
Reports1
Detections
35 Sigma rules tagged T1098Account ManipulationT109835 general rules
- Password Change on Directory Service Restore Mode (DSRM) Accounthighstable
- Active Directory User Backdoorshightest
- Anomalous User Activityhightest
- AWS User Login Profile Was Modifiedhightest
- Bulk Deletion Changes To Privileged Account Permissionshightest
- Cisco Local Accountshightest
- Enabled User Right in AD to Control User Objectshightest
- ESXi Admin Permission Assigned To Account Via ESXCLIhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Account Manipulation
19 CVEs, by priority. Each link shows its badge.- CVE-2026-81578PaperCut NG/MF Missing Authentication for Critical Function VulnerabilityPaperCut · NG/MFKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098Account Manipulation1 reportAI mapping from the description · primary impact84.7%Top 0.29%83.7priority
- CVE-2018-13382Fortinet FortiOS and FortiProxy Improper AuthorizationFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitHigh · 7.5T1190Exploit Public-Facing ApplicationT1098Account ManipulationAI mapping from the description · primary impact81.7%Top 0.36%78.2priority
- CVE-2026-20127Cisco Catalyst SD-WAN Controller and Manager Authentication Bypass VulnerabilityCisco · Catalyst SD-WAN Controller and ManagerKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1078Valid Accounts+1 moreAI mapping from the description · primary impact89.3%Top 0.22%75.0priority
- CVE-2026-34908Ubiquiti UniFi OS Improper Access Control VulnerabilityUbiquiti · UniFi OSKEVPublic exploitCritical · 10.0T1190Exploit Public-Facing ApplicationT1098Account ManipulationAI mapping from the description · primary impact88.3%Top 0.23%75.0priority
- CVE-2021-32030ASUS Routers Improper Authentication VulnerabilityASUS · RoutersKEVPublic exploitCritical · 9.8T1098Account ManipulationT1068Exploitation for Privilege Escalation+1 moreMITRE CTID mapping of the KEV entry · primary impact99.4%Top 0.06%69.8priority
- CVE-2024-11680ProjectSend Improper Authentication VulnerabilityProjectSend · ProjectSendKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098Account Manipulation+1 moreAI mapping from the description · primary impact91.8%Top 0.18%69.8priority
- CVE-2020-26919Netgear JGS516PE Devices Missing Function Level Access Control VulnerabilityNETGEAR · JGS516PE DevicesKEVPublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098Account ManipulationAI mapping from the description · primary impact57.5%Top 0.92%69.7priority
- CVE-2020-24363TP-link TL-WA855RE Missing Authentication for Critical Function VulnerabilityTP-Link · TL-WA855REKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1098Account ManipulationAI mapping from the description · primary impact22.2%Top 2.3%68.7priority
- CVE-2014-100005D-Link DIR-600 Router Cross-Site Request Forgery (CSRF) VulnerabilityD-Link · DIR-600 RouterKEVPublic exploitHigh · 8.0T1204.001Malicious LinkT1059Command and Scripting Interpreter+1 moreAI mapping from the description · primary impact43.5%Top 1.3%68.3priority
- CVE-2023-6448Unitronics Vision PLC and HMI Insecure Default Password VulnerabilityAI mapping from the description · primary impact2.1%Top 18%61.2priority
- CVE-2012-0767Adobe Flash Player Cross-Site Scripting (XSS) VulnerabilityAdobe · Flash PlayerKEVEnd of lifeMedium · 6.1T1204.001Malicious LinkT1098Account Manipulation+2 moreMITRE CTID mapping of the KEV entry · follow-on activity6.2%Top 6.5%46.0priority
- CVE-2020-5350Dell EMC Integrated Data Protection Appliance versions 2.0, 2.1, 2.2, 2.3, 2.4 contain a command injection…Dell · Integrated Data Protection ApplianceHigh · 7.9T1059Command and Scripting InterpreterT1098Account ManipulationMITRE CTID mapping of the CVE · follow-on activity2.0%Top 20%21.6priority
- CVE-2019-3787UAA defaults email address to an insecure domainMITRE CTID mapping of the CVE · follow-on activity1.1%Top 34%18.9priority
- CVE-2019-15956Cisco Web Security Appliance Unauthorized Device Reset VulnerabilityCisco · Cisco Web Security Appliance (WSA)High · 8.8T1078Valid AccountsT1190Exploit Public-Facing Application+2 moreMITRE CTID mapping of the CVE · primary impact1.0%Top 38%18.6priority
- CVE-2019-3775UAA allows users to modify their own email addressMITRE CTID mapping of the CVE · primary impact0.9%Top 41%16.8priority
- CVE-2020-0758An elevation of privilege vulnerability exists when Azure DevOps Server and Team Foundation Services improperly handle…Microsoft · Team Foundation Server 2018T1098Account ManipulationT1068Exploitation for Privilege EscalationMITRE CTID mapping of the CVE · how it is exploited2.0%Top 19%16.2priority
- CVE-2019-1915Multiple Cisco Unified Communications Products Cross-Site Request Forgery VulnerabilityCisco · Cisco Unified Communications ManagerMedium · 6.5T1189Drive-by CompromiseT1566Phishing+3 moreMITRE CTID mapping of the CVE · follow-on activity0.7%Top 48%14.9priority
- CVE-2019-3782CredHub CLI writes environment variable credentials to diskMITRE CTID mapping of the CVE · follow-on activity0.4%Top 71%10.3priority
- CVE-2020-5362Dell Client Consumer and Commercial platforms include an improper authorization vulnerability in the Dell…Dell · Dell Client Consumer and Commercial platformsHigh · 7.1T1098Account ManipulationT1068Exploitation for Privilege EscalationMITRE CTID mapping of the CVE · follow-on activity0.3%Top 78%9.3priority
Linked through a sub-technique
2 more- CVE-2022-40684Fortinet Multiple Products Authentication Bypass VulnerabilityFortinet · Multiple ProductsKEVRansomwarePublic exploitCritical · 9.8T1190Exploit Public-Facing ApplicationT1098.004SSH Authorized Keys>99.9%Top 0.02%79.9priority
- CVE-2025-24472Fortinet FortiOS and FortiProxy Authentication Bypass VulnerabilityFortinet · FortiOS and FortiProxyKEVRansomwarePublic exploitHigh · 8.1T1190Exploit Public-Facing ApplicationT1098.004SSH Authorized Keys7.2%Top 5.7%77.5priority