Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0
Alerts on Windows registry updates that set Winlogon SpecialAccounts Userlist to DWORD 0 to hide users.
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems), frack113 (SigmaHQ), DRL 1.1
- Published
- 2022-07-12
- Updated
- 2026-07-30
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags registry changes that set the Winlogon SpecialAccounts Userlist value to DWORD 0x00000000, matching a common technique to hide a user account from the Windows logon screen. Attackers use this to reduce account visibility and complicate discovery by defenders and users. The detection relies on registry set telemetry identifying the specific TargetObject path and the Details value of DWORD (0x00000000).
Reporting behind it
- thedfirreport.comhttps://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_special_accounts.yml
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0"
id: 12c54ab7-c634-40d5-9062-4d7e90b4fc8d
related:
- id: 8a58209c-7ae6-4027-afb0-307a78e4589a
type: obsolete
- id: 9ec9fb1b-e059-4489-9642-f270c207923d
type: similar
- id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd
type: derived
status: test
description: This rule flags registry changes that set the Winlogon SpecialAccounts Userlist value to DWORD 0x00000000, matching a common technique to hide a user account from the Windows logon screen. Attackers use this to reduce account visibility and complicate discovery by defenders and users. The detection relies on registry set telemetry identifying the specific TargetObject path and the Details value of DWORD (0x00000000).
references:
- https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/
- https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry
- https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_set/registry_set_special_accounts.yml
author: Nasreddine Bencherchali (Nextron Systems), frack113, Huntrule Team
date: 2022-07-12
modified: 2023-01-26
tags:
- attack.stealth
- attack.t1564.002
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains: \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
Details: DWORD (0x00000000)
condition: selection
falsepositives:
- Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_set/registry_set_special_accounts/info.yml
simulation:
- type: atomic-red-team
name: Create Hidden User in Registry
technique: T1564.002
atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
license: DRL-1.1