Hiding User Account Via SpecialAccounts Registry Key - CommandLine
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Sigma rule (View on GitHub)
1title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine
2id: 9ec9fb1b-e059-4489-9642-f270c207923d
3related:
4 - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd
5 type: similar
6status: experimental
7description: |
8 Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
9references:
10 - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
11 - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
12 - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
13 - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
14author: '@Kostastsale, @TheDFIRReport'
15date: 2022-05-14
16modified: 2024-08-23
17tags:
18 - attack.t1564.002
19logsource:
20 category: process_creation
21 product: windows
22detection:
23 selection:
24 Image|endswith: '\reg.exe'
25 CommandLine|contains|all:
26 - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
27 - 'add'
28 - '/v'
29 - '/d 0'
30 condition: selection
31falsepositives:
32 - System administrator activities
33level: medium
References
-
Key Takeaways In late December 2022, we observed threat actors exploiting a publicly exposed Remote Desktop Protocol (RDP) host, leading to data exfiltration and the deployment of Trigona ransomwar…
Read More -
Key Takeaways In late February 2023, threat actors rode a wave of initial access using Microsoft OneNote files. In this case, we observed a threat actor deliver IcedID using this method. After load…
Read More -
Key Takeaways In August 2023, we observed an intrusion that started with a phishing campaign using PrometheusTDS to distribute IcedID. IcedID dropped and executed a Cobalt Strike beacon, which was …
Read More -
In March 2022, we observed an intrusion on a public-facing Microsoft SQL Server. The end goal of this intrusion was to deploy a coin miner. Although deploying a coin miner on a vulnerable server af…
Read More
Related rules
- Hiding User Account Via SpecialAccounts Registry Key
- Hidden User Creation
- Potential Suspicious Activity Using SeCEdit
- Hiding local user accounts