{"id":"T1564.002","name":"Hidden Users","url":"https://attack.mitre.org/techniques/T1564/002","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0353","stix_id":"x-mitre-detection-strategy--c48fd7e3-fbfb-4ab5-b577-12cc0be21f2c","name":"Detection Strategy for Hidden User Accounts","url":"https://attack.mitre.org/detectionstrategies/DET0353","analytics":[{"id":"AN1001","stix_id":"x-mitre-analytic--6039c777-6a85-4df4-86b9-40d95796046e","name":"Analytic 1001","description":"Registry modifications to HKLM\\SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList setting user visibility to 0, or creation of user accounts not shown on login screen. Defender view: correlation of account creation with registry edits that mark users hidden.","url":"https://attack.mitre.org/detectionstrategies/DET0353#AN1001","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Security","channel":"EventCode=4720","data_component":"DC0014","data_component_name":"User Account Creation","log_source_slug":"wineventlog-security"},{"name":"WinEventLog:Sysmon","channel":"EventCode=13, 14","data_component":"DC0063","data_component_name":"Windows Registry Key Modification","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"AccountScope","description":"Restrict monitoring to privileged or unexpected accounts."},{"field":"BaselineHiddenUsers","description":"Whitelist accounts that are intentionally hidden by administrators."}],"live":true,"detection_strategies":["DET0353"],"techniques":["T1564.002"]},{"id":"AN1002","stix_id":"x-mitre-analytic--397a553d-c08d-497e-8fb0-9526f5a205bc","name":"Analytic 1002","description":"Use of gsettings or direct Display Manager modifications to hide users from greeter login screen. Defender view: anomalous command execution modifying org.gnome.login-screen or other greeter configurations.","url":"https://attack.mitre.org/detectionstrategies/DET0353#AN1002","platforms":["Linux"],"log_source_references":[{"name":"auditd:EXECVE","channel":"Execution of gsettings set org.gnome.login-screen disable-user-list true","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"},{"name":"auditd:FILE","channel":"Modification of Display Manager configuration files (/etc/gdm3/*, /etc/lightdm/*)","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"auditd-file"}],"mutable_elements":[{"field":"DisplayManagerScope","description":"Specify which Display Managers are in use to minimize noise."}],"live":true,"detection_strategies":["DET0353"],"techniques":["T1564.002"]},{"id":"AN1003","stix_id":"x-mitre-analytic--cabc275f-5097-4d2e-aabe-b49a31ba87b9","name":"Analytic 1003","description":"User creation or modification via dscl with IsHidden=1, UID<500, or plist edits to com.apple.loginwindow Hide500Users flag. Defender view: correlation of hidden account attributes with login screen exclusion.","url":"https://attack.mitre.org/detectionstrategies/DET0353#AN1003","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of dscl . create with IsHidden=1","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Modification of /Library/Preferences/com.apple.loginwindow plist","data_component":"DC0061","data_component_name":"File Modification","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"Creation of user account with UID <500","data_component":"DC0013","data_component_name":"User Account Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"UIDThreshold","description":"Tune detection based on acceptable UID ranges for hidden/system accounts."},{"field":"PlistScope","description":"Restrict plist monitoring to com.apple.loginwindow to reduce false positives."}],"live":true,"detection_strategies":["DET0353"],"techniques":["T1564.002"]}],"live":true,"version":"1.0","techniques":["T1564.002"]}],"sigma_rules":[{"id":"9ec9fb1b-e059-4489-9642-f270c207923d","title":"Hiding User Account Via SpecialAccounts Registry Key - CommandLine","author":"@Kostastsale, TheDFIRReport","status":"test","level":"medium","date":"2022-05-14","modified":"2024-08-23","description":"Detects changes to the registry key \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\" where the value is set to \"0\" in order to hide user account from being listed on the logon screen.\n","references":["https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/","https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/","https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/","https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.002"],"path":"rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user.yml","techniques":["T1564.002"],"cves":[]},{"id":"b22a5b36-2431-493a-8be1-0bae56c28ef3","title":"Hidden User Creation","author":"Daniil Yugoslavskiy, oscd.community","status":"test","level":"medium","date":"2020-10-10","modified":"2021-11-27","description":"Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md"],"logsource":{"product":"macos","category":"process_creation"},"tags":["attack.stealth","attack.t1564.002"],"path":"rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml","techniques":["T1564.002"],"cves":[]},{"id":"c2c76b77-32be-4d1f-82c9-7e544bdfe0eb","title":"Potential Suspicious Activity Using SeCEdit","author":"Janantha Marasinghe","status":"test","level":"medium","date":"2022-11-18","modified":"2022-12-30","description":"Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy","references":["https://blueteamops.medium.com/secedit-and-i-know-it-595056dee53d","https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/secedit"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.collection","attack.discovery","attack.persistence","attack.credential-access","attack.privilege-escalation","attack.execution","attack.stealth","attack.defense-impairment","attack.t1685.001","attack.t1547.001","attack.t1505.005","attack.t1556.002","attack.t1685","attack.t1574.007","attack.t1564.002","attack.t1546.008","attack.t1546.007","attack.t1547.014","attack.t1547.010","attack.t1547.002","attack.t1557","attack.t1082"],"path":"rules/windows/process_creation/proc_creation_win_secedit_execution.yml","techniques":["T1685.001","T1547.001","T1505.005","T1556.002","T1685","T1574.007","T1564.002","T1546.008","T1546.007","T1547.014","T1547.010","T1547.002","T1557","T1082"],"cves":[]},{"id":"f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd","title":"Hiding User Account Via SpecialAccounts Registry Key","author":"Nasreddine Bencherchali (Nextron Systems), frack113","status":"test","level":"high","date":"2022-07-12","modified":"2023-01-26","description":"Detects modifications to the registry key \"HKLM\\Software\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\Userlist\" where the value is set to \"0\" in order to hide user account from being listed on the logon screen.","references":["https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/","https://github.com/redcanaryco/atomic-red-team/blob/40b77d63808dd4f4eafb83949805636735a1fd15/atomics/T1564.002/T1564.002.md#atomic-test-3---create-hidden-user-in-registry"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1564.002"],"path":"rules/windows/registry/registry_set/registry_set_special_accounts.yml","techniques":["T1564.002"],"cves":[]}],"kev_cves":[],"_built":"2026-08-24 19:45 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}