kevmap

Techniques › T1564 › T1564.002

T1564.002 Hidden Users

stealth — Linux, macOS, Windows · attack.mitre.org · JSON

1
MITRE detection strategy
3
analytics
4
Sigma rules tagged attack.t1564.002
0
KEV CVEs mapped here
<p>Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.</p><p>In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes. To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value <code>Hide500Users</code> to <code>TRUE</code> in the <code>/Library/Preferences/com.apple.loginwindow</code> plist file. Every user has a userID associated with it. When the <code>Hide500Users</code> key value is set to <code>TRUE</code>, users with a userID under 500 do not appear on the login screen and in System Preferences. Using the command line, adversaries can use the <code>dscl</code> utility to create hidden user accounts by setting the <code>IsHidden</code> attribute to <code>1</code>. Adversaries can also hide a user’s home folder by changing the <code>chflags</code> to hidden.</p><p>Adversaries may similarly hide user accounts in Windows. Adversaries can set the <code>HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList</code> Registry key value to <code>0</code> for a specific user to prevent that user from being listed on the logon screen.</p><p>On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter. The method an adversary may use depends on which Display Manager the distribution is currently using. For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the <code>gsettings</code> command (ex: <code>sudo -u gdm gsettings set org.gnome.login-screen disable-user-list true</code>). Display Managers are not anchored to specific distributions and may be changed by a user or adversary.</p>

KEV CVEs mapped to this technique · CTID Mappings Explorer

None. No KEV entry in the public mapping names this technique. Given that 74.7% of KEV has no mapping at all, this says more about the mapping than about the technique.

Detection strategy · ATT&CK Enterprise v19.2

Sigma rules · SigmaHQ da9bb07d64, tag attack.t1564.002

Hiding User Account Via SpecialAccounts Registry Key - CommandLine mediumtest
Author: @Kostastsale, TheDFIRReport · 2022-05-14 (modified 2024-08-23) · logsource: product=windows category=process_creation · 9ec9fb1b-e059-4489-9642-f270c207923d
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Techniques: T1564.002
Hidden User Creation mediumtest
Author: Daniil Yugoslavskiy, oscd.community · 2020-10-10 (modified 2021-11-27) · logsource: product=macos category=process_creation · b22a5b36-2431-493a-8be1-0bae56c28ef3
Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
Techniques: T1564.002
Potential Suspicious Activity Using SeCEdit mediumtest
Author: Janantha Marasinghe · 2022-11-18 (modified 2022-12-30) · logsource: product=windows category=process_creation · c2c76b77-32be-4d1f-82c9-7e544bdfe0eb
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Techniques: T1685.001T1547.001T1505.005T1556.002T1685T1574.007T1564.002T1546.008T1546.007T1547.014T1547.010T1547.002T1557T1082
Hiding User Account Via SpecialAccounts Registry Key hightest
Author: Nasreddine Bencherchali (Nextron Systems), frack113 · 2022-07-12 (modified 2023-01-26) · logsource: product=windows category=registry_set · f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Techniques: T1564.002

Rules tagged at the parent level (attack.t1564) 10

These target the parent technique, not this sub-technique specifically. Listed for completeness, not counted as coverage.

Sysmon Configuration Modification hightest
Author: frack113 · 2021-06-04 (modified 2022-08-02) · logsource: product=windows category=sysmon_status · 1f2b5353-573f-4880-8e33-7d04dcf97744
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Techniques: T1564
CrashControl CrashDump Disabled mediumtest
Author: Tobias Michalski (Nextron Systems) · 2022-02-24 (modified 2023-08-17) · logsource: product=windows category=registry_set · 2ff692c2-4594-41ec-8fcb-46587de769e0
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Techniques: T1564T1112
PUA - System Informer Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2023-05-08 (modified 2024-11-23) · logsource: product=windows category=process_creation · 5722dff1-4bdd-4949-86ab-fbaf707e767a
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Techniques: T1082T1564T1543
Potentially Suspicious Execution From Parent Process In Public Folder hightest
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · 2022-02-25 (modified 2024-07-12) · logsource: product=windows category=process_creation · 69bd9b97-2be2-41b6-9816-fb08757a4d1a
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Techniques: T1564T1059
Suspicious Executable File Creation hightest
Author: frack113 · 2022-09-05 (modified 2023-12-11) · logsource: product=windows category=file_event · 74babdd6-a758-4549-9632-26535279e654
Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Techniques: T1564
PUA - Process Hacker Execution mediumtest
Author: Florian Roth (Nextron Systems) · 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · 811e0002-b13b-4a15-9d00-a613fce66e42
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.
Techniques: T1622T1564T1543
Sysmon Configuration Error hightest
Author: frack113 · 2021-06-04 (modified 2026-07-23) · logsource: product=windows category=sysmon_error · 815cd91b-7dbc-4247-841a-d7dd1392b0a8
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Techniques: T1564
Virtualbox Driver Installation or Starting of VMs lowtest
Author: Janantha Marasinghe · 2020-09-26 (modified 2025-07-29) · logsource: product=windows category=process_creation · bab049ca-7471-4828-9024-38279a4c04da
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Techniques: T1564.006T1564
Suspicious Creation with Colorcpl hightest
Author: frack113 · 2022-01-21 (modified 2023-01-05) · logsource: product=windows category=file_event · e15b518d-b4ce-4410-a9cd-501f23ce4a18
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Techniques: T1564
Mount Execution With Hidepid Parameter mediumtest
Author: Joseliyo Sanchez, @Joseliyo_Jstnk · 2023-01-12 · logsource: product=linux category=process_creation · ec52985a-d024-41e3-8ff6-14169039a0b3
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Techniques: T1564