Sigma rule: Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Rule

Title

Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Status

test

Level

medium

Author

@Kostastsale, TheDFIRReport

Date

2022-05-14

Modified

2024-08-23

File

rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Log source

product

windows

category

process_creation

Detection

selection:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
        - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
        - 'add'
        - '/v'
        - '/d 0'
condition: selection

False positives (as the rule lists them)

• System administrator activities

Tags

• attack.stealth
• attack.t1564.002

MITRE ATT&CK ids this rule names

• T1564.002

Related rules

• f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd (similar)

References

• https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
• https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
• https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
• https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml