Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1098.007sub-technique of T1098 Account Manipulation

Additional Local or Domain Groups

Windows · macOS · Linux1 piece on this siteT1098.007 on attack.mitre.org

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups. On Linux, adversaries may use the `usermod` command for the same purpose.

MITRE ATT&CK 19.2, retrieved 2026-09-12

If this is happening now

1

Checklists and playbooks to open while the alert is still live.

First 15MembersCONSTRUCTED

First 15 minutes: an account was added to Domain Admins

A tier-zero group changed and nobody has a ticket for it. Whoever made the change is at least as compromised as the account they added. How to confirm, contain and scope without handing the operator another credential.

T1098.007

how MITRE says to see it

Suspicious Addition to Local or Domain Groups

  • Detects unauthorized additions of users or machine accounts to privileged local or domain groups (e.g., Administrators, Remote Desktop Users).
  • Detects unexpected use of usermod, gpasswd, or direct modification of /etc/group to elevate user group membership.
  • Detects use of `dseditgroup` or `dscl` to add users to privileged macOS groups (e.g., admin).

the rest of T1098

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.