{"id":"460479f3-80b7-42da-9c43-2cc1d54dbccd","title":"Creation of a Local Hidden User Account by Registry","description":"Sysmon registry detection of a local hidden user account.","author":"Christian Burkard (Nextron Systems)","status":"test","level":"high","date":"2021-05-03","modified":"2025-10-31","tags":["attack.persistence","attack.t1136.001"],"technique_ids":["T1136.001"],"logsource":{"product":"windows","category":"registry_event"},"falsepositives":["Unknown"],"references":["https://twitter.com/SBousseaden/status/1387530414185664538"],"source_path":"rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml","source_sha256":"428895c6a5d104390fb656e4e028f1e02a9100b04243e6cbb54bd5bd1964a115","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/windows/registry/registry_event/registry_event_add_local_hidden_user.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Creation of a Local Hidden User Account by Registry\nid: 460479f3-80b7-42da-9c43-2cc1d54dbccd\nstatus: test\ndescription: Sysmon registry detection of a local hidden user account.\nreferences:\n    - https://twitter.com/SBousseaden/status/1387530414185664538\nauthor: Christian Burkard (Nextron Systems)\ndate: 2021-05-03\nmodified: 2025-10-31\ntags:\n    - attack.persistence\n    - attack.t1136.001\nlogsource:\n    product: windows\n    category: registry_event\ndetection:\n    selection:\n        TargetObject|contains: '\\SAM\\SAM\\Domains\\Account\\Users\\Names\\'\n        TargetObject|endswith: '$\\(Default)'\n        Image|endswith: '\\lsass.exe'\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: high\nregression_tests_path: regression_data/rules/windows/registry/registry_event/registry_event_add_local_hidden_user/info.yml\nsimulation:\n    - type: atomic-red-team\n      name: Create Hidden User in Registry\n      technique: T1564.002\n      atomic_guid: 173126b7-afe4-45eb-8680-fa9f6400431c\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1136.001","id":"T1136.001","name":"Local Account","page":"techniques/enterprise/T1136.001/"}],"data_path":"data/detection-rules/460479f3-80b7-42da-9c43-2cc1d54dbccd.json","kind":"sigma"}