Detection of Hidden Accounts and RID Hijacking in Windows
The threat actor created an account using the net user command. When a $ is added to the end of the account name during account creation, the account is created with a hidden attribute. In this case, the account cannot be identified using the (net user command), and can only be identified in the SAM registry. In a RID Hijacking attack, threat actors modify the RID value of an account in the SAM registry so that the Windows operating system recognizes it as a changed RID. In the Windows operating system, the registry key related to user accounts are stored in the path HKEY_LOCAL_MACHINE\ SAM\SAM\Domains\Account\Users. The RID of a user account is written in the little-endian format as 4 bytes in the 0x30 0x33 area of the F value under each account key. Threat actors change the value at this offset to the RID of the hijacking target.
Sigma
