New or Renamed User Account with '$' Character

SigmaHQ Detections@sigmaHQ

•updated Apr 28, 2026•0•0•0

Detects the creation of a user with the "$" character. This can be used by attackers to hide a user or trick detection systems that lack the parsing mechanisms.