Suspicious Hidden Account Registry Modification via SpecialAccounts

Andrew Northern@exraritas

•updated Mar 27, 2026•0•35

Detects registry modifications to the SpecialAccounts\UserList key, setting a value to 0 to hide an account from the Windows login screen. This technique is observed in the CTRL framework to conceal backdoor accounts (e.g., Administrator, Admin, Windows).