{"id":"T1098.007","name":"Additional Local or Domain Groups","url":"https://attack.mitre.org/techniques/T1098/007","tactics":["persistence","privilege-escalation"],"platforms":["Windows","macOS","Linux"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0310","stix_id":"x-mitre-detection-strategy--13233865-3b73-4065-a056-43fcd6eb6ed5","name":"Suspicious Addition to Local or Domain Groups","url":"https://attack.mitre.org/detectionstrategies/DET0310","analytics":[{"id":"AN0865","stix_id":"x-mitre-analytic--58bed5f5-6ef5-4558-9ac9-b58f8aa9888c","name":"Analytic 0865","description":"Detects unauthorized additions of users or machine accounts to privileged local or domain groups (e.g., Administrators, Remote Desktop Users).","url":"https://attack.mitre.org/detectionstrategies/DET0310#AN0865","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4728, 4729, 4732, 4733, 4756, 4757","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"wineventlog-security"}],"mutable_elements":[{"field":"TargetGroup","description":"Set to detect high-privileged groups like 'Administrators', 'Domain Admins', or 'Remote Desktop Users'"},{"field":"TimeWindow","description":"Restrict detections to business hours or approved maintenance windows"},{"field":"UserContext","description":"Filter out known automated processes or provisioning systems"}],"live":true,"detection_strategies":["DET0310"],"techniques":["T1098.007"]},{"id":"AN0866","stix_id":"x-mitre-analytic--ff692121-8bbd-4d22-8192-fe6a7dd94f57","name":"Analytic 0866","description":"Detects unexpected use of usermod, gpasswd, or direct modification of /etc/group to elevate user group membership.","url":"https://attack.mitre.org/detectionstrategies/DET0310#AN0866","platforms":["Linux"],"log_source_references":[{"name":"auditd:SYSCALL","channel":"SYSCALL for usermod or /etc/group file modification","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"auditd-syscall"}],"mutable_elements":[{"field":"GroupName","description":"Focus on 'sudo', 'wheel', or custom high-privilege groups"},{"field":"UserContext","description":"Account that initiated the change (e.g., service account or unrecognized user)"},{"field":"TimeWindow","description":"Detect elevation outside change windows"}],"live":true,"detection_strategies":["DET0310"],"techniques":["T1098.007"]},{"id":"AN0867","stix_id":"x-mitre-analytic--03b0d93e-955a-49f6-83ad-8cf72b678367","name":"Analytic 0867","description":"Detects use of `dseditgroup` or `dscl` to add users to privileged macOS groups (e.g., admin).","url":"https://attack.mitre.org/detectionstrategies/DET0310#AN0867","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Process execution or directory service changes","data_component":"DC0010","data_component_name":"User Account Modification","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"GroupName","description":"Focus on 'admin' or 'com.apple.access_ssh'"},{"field":"UserContext","description":"Detect unknown or transient users making group changes"},{"field":"TimeWindow","description":"Detect group modifications at suspicious times"}],"live":true,"detection_strategies":["DET0310"],"techniques":["T1098.007"]}],"live":true,"version":"1.0","techniques":["T1098.007"]}],"sigma_rules":[],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}