Hidden Local User Account Creation

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•25

Detects the creation of a local hidden user account on Windows systems. Hidden accounts are often indicated by a dollar sign ($) at the end of the username and can be used by adversaries for persistence.