Windows Registry User Profile Creation: ANONYMOUS _DomainUser_ Entries in ProfileList
Alerts on ProfileList registry writes indicating a new user profile with 'ANONYMOUS' and '_DomainUser_' markers.
FreeReviewedSigma · High · v5
- Product
- windows
- Category
- registry_set
- Author
- Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
- Published
- 2023-05-02
- Updated
- 2026-07-31
What it detects
This rule flags registry changes under Windows ProfileList paths that include a ProfileImagePath containing both the strings "ANONYMOUS" and "_DomainUser_". Creating or altering user profile entries in the registry can be used by malware to establish persistence or masquerade as legitimate user context. It relies on registry-set telemetry capturing TargetObject paths and their associated Details content.
Reporting behind it
Changelog
v5- v5Candidate ingested via manual entry.2026-07-31
- v4Candidate ingested via manual entry.2026-07-31
- v3Candidate ingested via manual entry.2026-07-31
- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
windows-registry-set-new-user-profile-created-with-anonymous-and-domainuser-mark-95214813
title: "Windows Registry User Profile Creation: ANONYMOUS _DomainUser_ Entries in ProfileList"
id: 05009d67-b91a-4466-a097-697987648325
status: test
description: This rule flags registry changes under Windows ProfileList paths that include a ProfileImagePath containing both the strings "ANONYMOUS" and "_DomainUser_". Creating or altering user profile entries in the registry can be used by malware to establish persistence or masquerade as legitimate user context. It relies on registry-set telemetry capturing TargetObject paths and their associated Details content.
references:
- https://www.ncsc.gov.uk/static-assets/documents/malware-analysis-reports/cold-steel/NCSC-MAR-Cold-Steel.pdf
- https://github.com/SigmaHQ/sigma/blob/master/rules-emerging-threats/2023/Malware/COLDSTEEL/registry_set_malware_coldsteel_created_users.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2023-05-02
modified: 2023-08-17
tags:
- attack.persistence
- detection.emerging-threats
logsource:
category: registry_set
product: windows
detection:
selection:
TargetObject|contains|all:
- \SOFTWARE\Microsoft\Windows NT\CurrentVersion\ProfileList\S-1-5-21-
- \ProfileImagePath
Details|contains:
- ANONYMOUS
- _DomainUser_
condition: selection
falsepositives:
- Unknown
level: high
license: DRL-1.1
related:
- id: 95214813-4c7a-4a50-921b-ee5c538e1d16
type: derived