New or Renamed User Account with '$' Character

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•25

Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.