Creation of a Local Hidden User Account by Registry
This rule detects the creation of a local hidden user account by monitoring Windows Registry events. Specifically, it looks for modifications within the 'SAM\SAM\Domains\Account\Users\Names\' registry path where the target object (the account name) ends with a '$' character, indicating a hidden account. The detection is further refined by ensuring the event is generated by 'lsass.exe', which is responsible for managing user accounts and authentication.
Sigma
