Query: Sigma rule for Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist
Matching passage: Sigma rule: Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist. Logsource: windows / process_creation. Rule: title: Hiding User Account Via SpecialAccounts Registry Key - CommandLine id: 9ec9fb1b-e059-4489-9642-f270c207923d related: - id: f8aebc67-a56d-4ec9-9fbe-7b0e8b7b4efd type: similar status: test description: 'Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen. ' references: - https://thedfirreport.com/2024/01/29/buzzing-on-christmas-eve-trigona-ransomware-in-3-hours/ - https://thedfirreport.com/2024/04/01/from-onenote-to-ransomnote-an-ice-cold-intrusion/ - https://thedfirreport.com/2024/04/29/from-icedid-to-dagon-locker-ransomware-in-29-days/ - https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/ author: '@Kostastsale, TheDFIRReport' date: 2022-05-14 modified: 2024-08-23 tags: - attack.stealth - attack.t1564.002 logsource: category: process_creation product: windows detection: selection: Image|endswith: \reg.exe CommandLine|contains|all: - \SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList - add - /v - /d 0 condition: selection falsepositives: - System administrator activities level: medium regression_tests_path: regression_data/rules/windows/process_creation/proc_creation_win_registry_special_accounts_hide_user/info.yml
Near-miss passage: Sigma rule: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows. Logsource: windows / file_event. Rule: title: Suspicious Double Extension Files id: b4926b47-a9d7-434c-b3a0-adc3fa0bd13e related: - id: 1cdd9a09-06c9-4769-99ff-626e2b3991b8 type: derived - id: 3215aa19-f060-4332-86d5-5602511f3ca8 type: similar status: test description: Detects dropped files with double extensions, which is often used by malware as a method to abuse the fact that Windows hide default extensions by default. references: - https://www.crowdstrike.com/blog/meet-crowdstrikes-adversary-of-the-month-for-june-mustang-panda/ - https://www.anomali.com/blog/china-based-apt-mustang-panda-targets-minority-groups-public-and-private-sector-organizations - https://www.cybereason.com/blog/research/a-bazar-of-tricks-following-team9s-development-cycles - https://twitter.com/malwrhunterteam/status/1235135745611960321 - https://twitter.com/luc4m/status/1073181154126254080 - https://cloud.google.com/blog/topics/threat-intelligence/cybercriminals-weaponize-fake-ai-websites - https://vipre.com/blog/svg-phishing-attacks-the-new-trick-in-the-cybercriminals-playbook/ author: Nasreddine Bencherchali (Nextron Systems), frack113 date: 2022-06-19 modified: 2026-03-31 tags: - attack.stealth - attack.t1036.007 logsource: category: file_event product: windows detection: selection_gen: TargetFilename|endswith: - .exe - .iso - .rar - .svg - .zip TargetFilename|contains: - .doc. - .docx. - .gif. - .jpeg. - .jpg. - .mp3. - .mp4. - .pdf. - .png. - .ppt. - .pptx. - .rtf. - .svg. - .txt. - .xls. - .xlsx. selection_exe: TargetFilename|endswith: - .rar.exe - .zip.exe filter_icons_linux: TargetFilename|startswith: /usr/share/icons/ condition: 1 of selection_* and not 1 of filter_* falsepositives: - Unlikely level: high