Andrew Northern
@exraritas0 followers22 downloads1 copy0 likes53 views
2 detections
Filters
Last updated
All Time
Detection languages
2
Categories
1
1
1
Platforms
2
MITRE Techniques
2
1
1
1
1
Detects registry modifications to the SpecialAccounts\UserList key, setting a value to 0 to hide an account from the Windows login screen. This technique is observed in the CTRL framework to conceal backdoor accounts (e.g., Administrator, Admin, Windows).
Detects the use of msiexec.exe to install a package from a remote URL that contains keywords associated with fake verification or captcha lures. This technique is used by threat actors in "Fake Captcha" campaigns to bypass script-based detections.
