All Detections

Hiding User Account Via SpecialAccounts Registry Key

Yamato Security Hayabusa@YamatoSecurityHayabusa
updated Jun 24, 2025023

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

Sigma