1200KM / detection
T1564.002 Hidden Users — Detection Rules
Detection workspace for T1564.002 Hidden Users: 4 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Hidden User Creation · test · medium · {"category":"process_creation","product":"macos"}
- Hiding User Account Via SpecialAccounts Registry Key - CommandLine · test · medium · {"category":"process_creation","product":"windows"}
- Potential Suspicious Activity Using SeCEdit · test · medium · {"category":"process_creation","product":"windows"}
- Hiding User Account Via SpecialAccounts Registry Key · test · high · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0353 Detection Strategy for Hidden User Accounts
AN1001 Analytic 1001
Registry modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList setting user visibility to 0, or creation of user accounts not shown on login screen. Defender view: correlation of account creation with registry edits that mark users hidden.
AN1002 Analytic 1002
Use of gsettings or direct Display Manager modifications to hide users from greeter login screen. Defender view: anomalous command execution modifying org.gnome.login-screen or other greeter configurations.
AN1003 Analytic 1003
User creation or modification via dscl with IsHidden=1, UID<500, or plist edits to com.apple.loginwindow Hide500Users flag. Defender view: correlation of hidden account attributes with login screen exclusion.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
T1564.002 simulation workspace
- Command Execution · DC0064
- File Modification · DC0061
- User Account Creation · DC0014
- User Account Metadata · DC0013
- Windows Registry Key Modification · DC0063
No reviewed association in this snapshot.
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.