huntrule

Windows Registry: lsass.exe Creating Local Hidden User Account Entries

Alerts when lsass.exe writes hidden local user name entries to the SAM\...\Users\Names\ registry path.

FreeUnreviewedSigmahighv1
title: "Windows Registry: lsass.exe Creating Local Hidden User Account Entries"
id: 77799e78-6e7a-4e2f-9a42-3b38ba5cf289
status: test
description: This rule flags Sysmon registry events where lsass.exe writes to the SAM registry path for hidden local user names under \SAM\SAM\Domains\Account\Users\Names\, matching entries that end with '$\(Default)'. Attackers may use this technique to establish persistence by creating hidden local accounts that are harder to enumerate through standard user listings. Detection relies on registry event telemetry with the TargetObject value and the process path of lsass.exe.
references:
  - https://twitter.com/SBousseaden/status/1387530414185664538
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml
author: Christian Burkard (Nextron Systems), Huntrule Team
date: 2021-05-03
modified: 2025-10-31
tags:
  - attack.persistence
  - attack.t1136.001
logsource:
  product: windows
  category: registry_event
detection:
  selection:
    TargetObject|contains: \SAM\SAM\Domains\Account\Users\Names\
    TargetObject|endswith: $\(Default)
    Image|endswith: \lsass.exe
  condition: selection
falsepositives:
  - Unknown
level: high
regression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml
simulation:
  - type: atomic-red-team
    name: Create Hidden User in Registry
    technique: T1564.002
    atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c
license: DRL-1.1
related:
  - id: 460479f3-80b7-42da-9c43-2cc1d54dbccd
    type: derived

What it detects

This rule flags Sysmon registry events where lsass.exe writes to the SAM registry path for hidden local user names under \SAM\SAM\Domains\Account\Users\Names\, matching entries that end with '$\(Default)'. Attackers may use this technique to establish persistence by creating hidden local accounts that are harder to enumerate through standard user listings. Detection relies on registry event telemetry with the TargetObject value and the process path of lsass.exe.

Known false positives

  • Unknown

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.