Hiding User Account Via SpecialAccounts Registry Key

SigmaHQ Detections@sigmaHQ

•updated Aug 14, 2025•1•0•23

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide a user account from being listed on the logon screen. This is a defense evasion technique used by adversaries to maintain stealth.