Hiding User Account Via SpecialAccounts Registry Key

Title: Hiding User Account Via SpecialAccounts Registry Key
Status: test
Description:Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
References:
  -https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  -https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
Author: Nasreddine Bencherchali (Nextron Systems), frack113
Date: 2022-07-12
modified:2023-01-26
Tags:

• -'attack.stealth'
• -'attack.t1564.002'

Logsource:

• category: registry_set
• product: windows

Detection:
  selection:
    TargetObject|contains: '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
    Details: 'DWORD (0x00000000)'
  condition:selection
Falsepositives:
  -Unknown
Level: high