Hidden local account creation

Identifies the creation of a hidden local account. Adversaries can create hidden accounts by appending the dollar sign to the account name. This technique renders the account name hidden to user enumeration tools such as `net user` and effectively bypasses detections.

• Platform: Windows
• Severity: High
• MITRE Tactic: Persistence
• MITRE Techniques: T1136, T1136.001

Back to all rules