MITRE ATT&CK T1098 — Account Manipulation

Name: MITRE ATT&CK T1098 — Account Manipulation
Rating: 85 (1 reviews)
Author: santosomar

Trust Score 85/100

Defensive analysis and guidance for MITRE ATT&CK technique T1098 (Account Manipulation): detection, triage, hunting, and mitigation planning for enterprise envi

triggers:T1098account manipulationATT&CKdetection engineeringthreat huntingincident response

GitHub SKILL.md

What it does

Provides a defensive-focused skill that analyzes MITRE ATT&CK technique T1098 (Account Manipulation). It helps the agent map evidence to the ATT&CK technique, produce detection hypotheses, create triage and hunt plans, and generate mitigation and containment recommendations. The skill bundles structured metadata, templates, and rendering scripts to produce concise defensive briefs.

When to use it

Use this skill when investigating account manipulation behaviors, planning detection logic for account-related TTPs, drafting threat-hunting playbooks, conducting incident-response mapping, or preparing controlled adversary-emulation exercises. It's intended for defensive analysts and detection engineers seeking ATT&CK-mapped outputs.

What's included

Scripts: scripts/render_brief.py (render detection briefs)
References: references/technique-profile.json, references/detection-and-mitigation.md, references/known-threat-context.md
Templates: detection brief, hunt plan, incident-response note, coverage assessment
Instructions: the skill body describes an agent workflow (scope clarification, resource loading, mapping observations to ATT&CK, and safe output patterns).

Compatible agents

Best used by agents that can run local scripts and produce structured text outputs (automation-capable assistants used for security analysis, e.g., code-capable agents and automation runners).

Audit Summary

MITRE ATT&CK T1098 (Account Manipulation) defensive analysis skill with clean SKILL.md and one bundled script (render_brief.py). The script is a straightforward JSON-to-Markdown renderer that crashed because its bundled references/technique-profile.json was not available in the test sandbox. No security concerns — purely defensive guidance with explicit safety guardrails. Well-structured frontmatter and resource organization.

Watch Out

render_brief.py requires references/technique-profile.json to exist alongside the skill directory — will crash with FileNotFoundError if the full skill directory isn't present
No try/except around file reads in the script

Notes

Part of the santosomar/mitre-attack-agent-skills collection. Purely defensive/security-oriented skill. Script failure is due to missing bundled data file, not a code defect. Clean, no security issues.

Information

Repository: mitre-attack-agent-skills
Stars: 18

Trust Score

Overall85

Security95

Code Quality72

Architecture78

Usefulness55

More from mitre-attack-agent-skills

MITRE ATT&CK — T1569.001 Launchctl

Defensive analysis skill for MITRE ATT&CK T1569.001 (Launchctl): detection, triage, and mitigation guidance for macOS adversary activity.

MITRE ATT&CK T1557.001: Name Resolution Poisoning & SMB Relay

Defensive analysis skill for MITRE ATT&CK T1557.001: helps triage, detection engineering, hunting, and incident response for name-resolution poisoning and SMB r

ATT&CK T1560.003 — Archive via Custom Method

Defensive analysis skill for MITRE ATT&CK T1560.003: helps map observations, produce detection ideas, and create triage and mitigation briefs for custom archive

MITRE ATT&CK — Hidden Files & Directories (T1564.001)

Defensive analysis aid for MITRE ATT&CK T1564.001 to help triage, detection engineering, hunting, and incident response around hidden files and directories.

MITRE ATT&CK T1633.001 — System Checks

Defensive analysis skill for MITRE ATT&CK T1633.001 (System Checks) — aids triage, detection engineering, hunting, and emulation planning for mobile platforms.

Related Skills

Reverse Engineer

Provides step-by-step guidance and best practices for binary reverse engineering: static analysis, dynamic tracing, disassembly, and documentation workflows for

Sandbox0 Integration

Guidance and templates for integrating Sandbox0 sandboxing into AI agents — CLI/SDK patterns, templates, volumes, network policy, and deployment choices.

CTF Write-up Generator

Generate a concise, reproducible submission-style CTF writeup with a one-path solution script, metadata, and a short checklist for fast verification.

Azure External Attack Surface Management

Provides expert guidance for Azure External Attack Surface Management (EASM): quotas, configuration, integrations, and exporting inventory to analytics platform

Node.js Best Practices

Guidelines and decision-making for Node.js architecture, runtime, async patterns, security, validation, and testing to inform framework and system choices.

radar — Smart Contract AST & Security Analysis

Multi-framework AST generator and static analysis tool for smart contracts (Rust/Anchor/Stylus and Solidity/Foundry) with a template DSL for writing detection r

Bash Pro

Defensive, production-grade Bash scripting patterns and CI/CD best practices: strict mode, safe argument parsing, testing with Bats, and tooling (ShellCheck/shf

Analyzing Ransomware Leak Site Intelligence

Collect and analyze ransomware data-leak site (DLS) posts to extract victim, group, sector and geographic trends for threat intelligence and proactive defense.

Back to Skills