Hide User Account via SpecialAccounts Registry Key Modification
Detects attempts to hide a user account from the Windows logon screen by modifying the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' registry key. Specifically, this rule looks for the use of 'reg.exe' to add a value of '0' to this key, which effectively hides the specified user account.
Sigma
