AD User ProfilePath Attribute Modification

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects changes to the 'ProfilePath' attribute of an Active Directory user account. Attackers can modify this attribute to point to a roaming profile to establish persistence or lateral movement within a network. One of the example includes updating the profilepath to network share to sync malicious NTUSER.MAN files for registry persistence. Since, this event can be generated during legitimate administrative activities, it is recommended to validate the legitimacy of such changes by cross-referencing with change management logs or known administrative actions.

2026-01-21 00:00:00

None

e995b53a-8ab0-4075-9ebc-c3f982db98f1

attack.persistence attack.lateral-movement attack.privilege-escalation attack.t1098

Nextron Sigma feed only (private)