APT5G1023 ↗
Has created their own accounts with Local Administrator privileges to maintain access to systems with short-cycle credential rotation.1
tfMITRE ATT&CK sub-technique
Additional Local or Domain Groups T1098.007
sub-technique of T1098 Account Manipulation
- Tactics
- Persistence, Privilege Escalation
- Platforms
- Windows, macOS, Linux
- Version
- 1.1
- Created
- 05 August 2024
- Last modified
- 26 September 2025
- Contributor
- Madhukar Raina (Senior Security Researcher - Hack The Box, UK)
An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain.
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
7
Threat groupsTop 23%
Threat groups77th percentile · 77% of ATT&CK techniques have this many threat groups attributed or fewer.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.4
Tools & malware62nd pct
Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.0
Detection rulesNone recorded
Detection rulesNone recorded · 33% of ATT&CK techniques have none either.Additional Local or Domain Groups MITRE reference T1098.007
Top 23%of all ATT&CK techniques for number of groups
7 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
FIN13G1016 ↗
Has assigned newly created accounts the sysadmin role to maintain persistence.1
APT41G0096 ↗
Has added user accounts to the User and Admin groups.1
KimsukyG0094 ↗
Has added accounts to specific groups with net localgroup.1
Magic HoundG0059 ↗
Has added a user named DefaultAccount to the Administrators and Remote Desktop Users groups.1
DragonflyG0035 ↗
Has added newly created accounts to the administrators group to maintain elevated access.1
All 7 groups for this technique · 6 newest in this preview
4 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
DarkGateS1111 ↗
Elevates accounts created through the malware to the local administration group during execution.1
SMOKEDHAMS0649 ↗
Has added user accounts to local Admin groups.1
ServHelperS0382 ↗
Has added a user named "supportaccount" to the Remote Desktop Users and Administrators groups.1
NetS0039 ↗
The net localgroup and net group commands in Net can be used to add existing users to local and domain groups.1 2
All 4 software entries for this technique
Offense vs defense T1098.007
Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.
Additional Local or Domain Groups detection strategy DET0310
MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Suspicious Addition to Local or Domain Groups
3 platforms
AN0865 · Windows
Detects unauthorized additions of users or machine accounts to privileged local or domain groups (e.g., Administrators, Remote Desktop Users).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | WinEventLog:Security | EventCode=4728, 4729, 4732, 4733, 4756, 4757 |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| TargetGroup | Set to detect high-privileged groups like 'Administrators', 'Domain Admins', or 'Remote Desktop Users' |
| TimeWindow | Restrict detections to business hours or approved maintenance windows |
| UserContext | Filter out known automated processes or provisioning systems |
AN0866 · Linux
Detects unexpected use of usermod, gpasswd, or direct modification of /etc/group to elevate user group membership.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | auditd:SYSCALL | SYSCALL for usermod or /etc/group file modification |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GroupName | Focus on 'sudo', 'wheel', or custom high-privilege groups |
| UserContext | Account that initiated the change (e.g., service account or unrecognized user) |
| TimeWindow | Detect elevation outside change windows |
AN0867 · macOS
Detects use of dseditgroup or dscl to add users to privileged macOS groups (e.g., admin).
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
| Data component | Name | Channel |
|---|---|---|
| User Account ModificationDC0010 | macos:unifiedlog | Process execution or directory service changes |
Tunable fields
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
| Field | What you tune |
|---|---|
| GroupName | Focus on 'admin' or 'com.apple.access_ssh' |
| UserContext | Detect unknown or transient users making group changes |
| TimeWindow | Detect group modifications at suspicious times |