Hiding User Account Via SpecialAccounts Registry Key - CommandLine

Title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine
Status: test
Description:Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
References:
  -https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
  -https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
  -https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
  -https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
Author: @Kostastsale, TheDFIRReport
Date: 2022-05-14
modified:2024-08-23
Tags:

• -'attack.stealth'
• -'attack.t1564.002'

Logsource:

• category: process_creation
• product: windows

Detection:
  selection:
    Image|endswith: '\reg.exe'
    CommandLine|contains|all:
      -'\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
      -'add'
      -'/v'
      -'/d 0'

  condition:selection
Falsepositives:
  -System administrator activities
Level: medium