Suspicious Hiding User Account Through SpecialAccounts Registry Key - CommandLine (via process_creation)

title: Suspicious Hiding User Account Through SpecialAccounts Registry Key - CommandLine (via process_creation)
id: 3cf3b785-3bd9-5310-b33b-00df6d9cf026
status: stable
description: This rule detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" to hide user account from being listed on the logon screen.
references:
    - https://attack.mitre.org/techniques/T1564/002/
    - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/
    - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/
    - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/
    - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
author: 'Huntrule Team'
date: 2026-07-13
tags:
    - attack.stealth
    - attack.t1564.002
logsource:
    category: process_creation
    product: windows
detection:
    selection:
        Image|endswith: '\reg.exe'
        CommandLine|contains|all:
            - '\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList'
            - 'add'
            - '/v'
            - '/d 0'
    condition: selection
falsepositives:
    - Unknown
level: medium
regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/info.yml