Creation of a Local Hidden User Account by Registry

Title: Creation of a Local Hidden User Account by Registry
Status: test
Description:Sysmon registry detection of a local hidden user account.
References:
  -https://twitter.com/SBousseaden/status/1387530414185664538
Author: Christian Burkard (Nextron Systems)
Date: 2021-05-03
modified:2025-10-31
Tags:

• -'attack.persistence'
• -'attack.t1136.001'

Logsource:

• product: windows
• category: registry_event

Detection:
  selection:
    TargetObject|contains: '\SAM\SAM\Domains\Account\Users\Names\'
    TargetObject|endswith: '$\(Default)'
    Image|endswith: '\lsass.exe'
  condition:selection
Falsepositives:
  -Unknown
Level: high