User Account Hidden via Registry SpecialAccounts Key

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•1

This Suricata rule detects network traffic on TCP port 445 (SMB) that contains the strings "SpecialAccounts" and "UserList" (case-insensitive). This pattern is indicative of an attempt to hide a user account on a Windows system by modifying the registry's SpecialAccounts\UserList key. This technique is often used by adversaries for defense evasion.