Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0

title: "Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0"
id: 12c54ab7-c634-40d5-9062-4d7e90b4fc8d
related:
  - id: 8a58209c-7ae6-4027-afb0-307a78e4589a
    type: obsolete
  - id: 9ec9fb1b-e059-4489-9642-f270c207923d
    type: similar
  - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd
    type: derived
status: test
description: This rule flags registry changes that set the Winlogon SpecialAccounts Userlist value to DWORD 0x00000000, matching a common technique to hide a user account from the Windows logon screen. Attackers use this to reduce account visibility and complicate discovery by defenders and users. The detection relies on registry set telemetry identifying the specific TargetObject path and the Details value of DWORD (0x00000000).
references:
  - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
  - https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_special_accounts.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-07-12
modified: 2023-01-26
tags:
  - attack.stealth
  - attack.t1564.002
logsource:
  category: registry_set
  product: windows
detection:
  selection:
    TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
    Details: DWORD (0x00000000)
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml
simulation:
  - type: atomic-red-team
    name: Create Hidden User in Registry
    technique: T1564.002
    atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
license: DRL-1.1