ATT&CK technique
View on MITRE ATT&CK →
T1564.002
Hidden Users
Stealth
8 detections found
Detection rules
| Source | Rule | Status | Updated |
|---|---|---|---|
| elastic | Creation of a Hidden Local User Account | production | 2026-09-18 |
| elastic | Unusual Interactive Shell Launched from System User | production | 2026-09-18 |
| elastic | Unusual Login via System User | production | 2026-09-18 |
| elastic | Potential Hidden Local User Account Creation | production | 2026-09-18 |
| sigma | Hiding User Account Via SpecialAccounts Registry Key - CommandLine | test | 2024-08-23 |
| sigma | Hiding User Account Via SpecialAccounts Registry Key | test | 2023-01-26 |
| sigma | Potential Suspicious Activity Using SeCEdit | test | 2022-12-30 |
| sigma | Hidden User Creation | test | 2021-11-27 |