In this room, we focus on Account Manipulation as a persistence mechanism in Windows environments. User accounts, groups, password changes, and privilege assignments are a normal part of Windows and Active Directory administration - IT teams use them to onboard users, manage access, maintain service accounts, and grant temporary admin privileges.

However, these same mechanisms can be abused by attackers who already have access. Instead of relying on malware or other persistence methods, an attacker can manipulate accounts to ensure they can return later - creating a new account, re-enabling a disabled one, resetting a password, or adding a user to a privileged group. This makes account-based persistence especially dangerous.

You will learn to identify, analyze, and validate account manipulation persistence using Windows Event Logs, Active Directory evidence, local account artifacts, group membership data, and live-response techniques.

Learning Objectives

By the end of this room, you will be able to:

• Understand how account manipulation can be used for persistence.
• Identify suspicious local and domain account changes in a compromised environment.
• Analyze privileged group membership changes related to persistence.
• Use Windows Event Logs and DFIR artifacts to investigate account-based persistence.
• Practice investigating a realistic account manipulation persistence scenario.

Prerequisites

Before starting this room, you should be familiar with:

• Basic Windows internals
• Windows local users and groups
• Basic Active Directory concepts
• Windows Event Logs
• Fundamental Incident Response concepts
• Previous Windows IR-focused rooms

Machine Access

Launch DefenseBox by clicking Start DefenseBox and use this machine for practical exercises. You can also connect over OpenVPN and RDP using the credentials below.