TACTIC: PERSISTENCE
Account Manipulation (T1098): Real Cases
MITRE Definition ↗ Adversaries add unauthorized OAuth credentials, SSH keys, or application secrets to existing privileged accounts to maintain silent persistence.
Key Facts
Technique ID
T1098
Persistence
Mapped Cases
1
Primary sources
Related Laws
0
Criminal statutes
- ATT&CK Technique Identifier: T1098.
- Tactical Phase: Persistence.
- Substantiated in 1 primary court prosecution and advisory cases.
- Linked records cite judicial dockets, plea agreements, or federal advisories.
Verified Evidentiary Case Records (1)
Microsoft Corporate Executive Email Intrusion (Midnight Blizzard / SVR)
investigation 2024-01-19
Russian Foreign Intelligence Service (SVR / Midnight Blizzard / APT29) compromised Microsoft corporate email systems via a password spray campaign against a legacy non-production test tenant lacking multi-factor authentication. Attackers leveraged the test account's permissions to grant full OAuth app-level access, reading executive emails and exfiltrating source code and customer cryptographic secrets.
Kill-Chain Phase: Privilege Escalation (OAuth Application Creation and Role Assignment)
After compromising the test account, Midnight Blizzard leveraged its permissions to create high-privilege OAuth applications and assign the full_access_as_app role for Exchange Web Services.
U.S. Securities and Exchange Commission & CISA Emergency Directive 24-02 · SEC-2024-8K-MSFT
View full case dossier →