Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
35 detections
Filters
Last updated
All Time
Detection languages
25
5
1
1
1
Contributors
9
8
8
3
2
Categories
16
10
5
4
3
Platforms
23
12
1
Products / Services
8
8
7
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects multiple activities associated with the CTRL framework, including hiding user accounts, persistence via scheduled tasks, UAC bypass using wlrmdr.exe, RDP shadow session hijacking, VPN disconnects via rasdial, and RDP restriction loosening.
Sysmon registry detection of a local hidden user account.
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide a user account from being listed on the logon screen. This is a defense evasion technique used by adversaries to maintain stealth.
Detects attempts to hide a user account from the Windows logon screen by modifying the 'HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList' registry key. Specifically, this rule looks for the use of 'reg.exe' to add a value of '0' to this key, which effectively hides the specified user account.
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detect modification for a specific user to prevent that user from being listed on the logon screen
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.
Detect modification for a specific user to prevent that user from being listed on the logon screen
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
Page 2 of 2