
title: Creation of a Local Hidden User Account by Registry
author: Christian Burkard
date: 2021/05/03
description: Sysmon registry detection of a local hidden user account.
detection:
  SELECTION_1:
    EventID: 12
  SELECTION_2:
    EventID: 13
  SELECTION_3:
    EventID: 14
  SELECTION_4:
    TargetObject: HKLM\SAM\SAM\Domains\Account\Users\Names\\*
  SELECTION_5:
    TargetObject: '*$'
  SELECTION_6:
    Image: '*lsass.exe'
  condition: ((SELECTION_1 or SELECTION_2 or SELECTION_3) and SELECTION_4 and SELECTION_5
    and SELECTION_6)
falsepositives:
- unknown
id: 460479f3-80b7-42da-9c43-2cc1d54dbccd
level: high
logsource:
  category: registry_event
  product: windows
modified: 2021/05/12
references:
- https://twitter.com/SBousseaden/status/1387530414185664538
status: experimental
tags:
- attack.persistence
- attack.t1136.001
ruletype: SIGMA
