T1564.002 — Hidden Users

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.002 Hide Artifacts: Hidden Users

title: "T1564.002 Hide Artifacts: Hidden Users"
id: a251bbe6-66d2-4dd0-8f99-bc427b1d01d0
description: 'Detects registry modifications to the SpecialAccounts\UserList key, which controls whether a local user account is hidden from the Windows logon screen and User Accounts control panel. (Data Component: Windows Registry Key Modification; baseline tier: windows-eventid.) Tune using: AccountScope, BaselineHiddenUsers.'
references:
  - https://attack.mitre.org/techniques/T1564/002
author: Shahrukh Khan
date: 2026-02-19
license: MIT
tags:
  - attack.stealth
  - attack.t1564.002

logsource:
  category: registry_event
  product: windows
  service: sysmon

detection:
  selection:
    EventID:
      - 12
      - 13
      - 14
    TargetObject|contains: '\SpecialAccounts\UserList\'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate admin tooling that hides service/management accounts from the login screen by design.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1564.002 Hide Artifacts: Hidden Users

title: "T1564.002 Hide Artifacts: Hidden Users"
id: e56bc245-56f8-4b99-917e-9dbca9371a52
description: 'Detection Strategy for Hidden User Accounts. Retargeted from useradd/usermod UID-0 and nologin-shell checks (generic account-manipulation noise) to the actual Linux-specific mechanism: gsettings/dconf commands writing org.gnome.login-screen disable-user-list=true, which hides accounts from the GDM greeter. Tune using: DisplayManagerScope.'
references:
  - https://attack.mitre.org/techniques/T1564/002
author: Shahrukh Khan
date: 2026-06-03
license: MIT
tags:
  - attack.stealth
  - attack.t1564.002

logsource:
  category: process_creation
  product: linux

detection:
  selection_tool:
    type: EXECVE
    a0|endswith:
      - '/gsettings'
      - '/dconf'
  keywords:
    - 'login-screen'
    - 'disable-user-list'

  condition: selection_tool and all of keywords

falsepositives:
  - Legitimate greeter customization by system administrators using gsettings/dconf for accessibility, branding, or kiosk-mode configuration.

level: high

T1564.002 Hide Artifacts: Hidden Users

title: "T1564.002 Hide Artifacts: Hidden Users"
id: ee492843-e58a-4752-8c61-6c71cd557e38
description: 'Detection Strategy for Hidden User Accounts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: UIDThreshold, PlistScope.'
references:
  - https://attack.mitre.org/techniques/T1564/002
author: Shahrukh Khan
date: 2026-03-17
license: MIT
tags:
  - attack.stealth
  - attack.t1564.002

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/dscl'
    CommandLine|contains|all:
      - 'IsHidden'
      - '1'

  condition: selection

falsepositives:
  - IT provisioning a legitimate service account and intentionally hiding it from the login window using approved MDM scripts.

level: high

Related sub-techniques

Explore