T1098.007 — Additional Local or Domain Groups

Tactics: Persistence, Privilege Escalation · Platforms: Windows, macOS, Linux

An adversary may add additional local or domain groups to an adversary-controlled account to maintain persistent access to a system or domain. On Windows, accounts may use the `net localgroup` and `net group` commands to add existing users to local and domain groups. On Linux, adversaries may use…

Sub-technique of Account Manipulation (T1098).

Sigma detection rules (3)

T1098.007 Account Manipulation: Additional Local or Domain Groups

title: "T1098.007 Account Manipulation: Additional Local or Domain Groups"
id: 10d339ea-c8e3-44d6-8d2e-23271147dc4e
description: 'Suspicious Addition to Local or Domain Groups. (Data Component: User Account Modification; baseline tier: windows-eventid.) Tune using: TargetGroup, TimeWindow, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1098/007
author: Shahrukh Khan
date: 2026-04-09
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.007

logsource:
  product: windows
  service: security

detection:
  selection:
    EventID:
      - '4728'
      - '4729'
      - '4732'
      - '4733'
      - '4756'
      - '4757'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1098.007 Account Manipulation: Additional Local or Domain Groups

title: "T1098.007 Account Manipulation: Additional Local or Domain Groups"
id: c8144e14-92cb-4922-99de-c04f7838cf22
description: 'Suspicious Addition to Local or Domain Groups. The prior exact match a1: "-aG" missed the equally common two-argument form "usermod -a -G group user" and long-option variants (--append --groups), so a large share of real usermod invocations for this behavior were missed. Broadened to match both the combined -aG flag and the split -a/-G (or --append/--groups) argv forms. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GroupName, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1098/007
author: Shahrukh Khan
date: 2026-03-16
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.007

logsource:
  product: linux
  service: auditd

detection:
  selection_combined:
    type: EXECVE
    a0|endswith: '/usermod'
    a1|contains:
      - '-aG'
      - '--append'
    a2|contains:
      - 'sudo'
      - 'wheel'
      - 'docker'
      - 'root'
  selection_split:
    type: EXECVE
    a0|endswith: '/usermod'
    a1|contains:
      - '-a'
      - '--append'
    a2|contains:
      - '-G'
      - '--groups'
    a3|contains:
      - 'sudo'
      - 'wheel'
      - 'docker'
      - 'root'

  condition: 1 of selection_*

falsepositives:
  - Adding a user to sudo/wheel/docker groups is routine during legitimate provisioning; flag additions performed outside CM tooling or by non-admin accounts.

level: high

T1098.007 Account Manipulation: Additional Local or Domain Groups

title: "T1098.007 Account Manipulation: Additional Local or Domain Groups"
id: 20cecff5-9b51-4c3c-93fe-94a0d3cc93c8
description: 'Suspicious Addition to Local or Domain Groups. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: GroupName, UserContext, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1098/007
author: Shahrukh Khan
date: 2026-02-09
license: MIT
tags:
  - attack.persistence
  - attack.privilege-escalation
  - attack.t1098.007

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dseditgroup'
    CommandLine|contains:
      - '-o edit'
      - '-a'

  condition: selection

falsepositives:
  - Provisioning scripts adding users to project-specific groups during legitimate onboarding.

level: high

Related sub-techniques

Explore