tfMITRE ATT&CK sub-technique

Hidden Users T1564.002

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 13 March 2020
Last modified: 12 May 2026
Contributor: Omkar Gudhate

Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware44th pct

Tools & malware44th percentile · 56% of ATT&CK techniques have more tools implementing them.

Detection rules60th pct

Detection rules60th percentile · 60% of ATT&CK techniques have this many detection rules written or fewer.

Hidden Users MITRE reference T1564.002

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

KimsukyG0094 ↗

Has run reg add ‘HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList’ /v to hide a newly created user.1

created 2019-08-261 referenceaka Black Banshee

DragonflyG0035 ↗

Has modified the Registry to hide created user accounts.1

created 2017-05-311 referenceaka TEMP.Isotope

All 2 groups for this technique

Offense vs defense T1564.002

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

How it got here

Range

Adversary activity (campaign spans) over cumulative rule output. Each source is plotted independently from zero, so neither line includes the other. Campaign dates are year-granularity.

Campaigns · 0Sigma rules (cumulative) · 4Splunk ESCU (cumulative) · 0

first rule: 2020 Q4

Hidden Users detection strategy DET0353

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hidden User Accounts

Enterprise

3 platforms

AN1001 · Windows

Registry modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList setting user visibility to 0, or creation of user accounts not shown on login screen. Defender view: correlation of account creation with registry edits that mark users hidden.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account CreationDC0014	WinEventLog:Security	EventCode=4720
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AccountScope	Restrict monitoring to privileged or unexpected accounts.
BaselineHiddenUsers	Whitelist accounts that are intentionally hidden by administrators.

AN1002 · Linux

Use of gsettings or direct Display Manager modifications to hide users from greeter login screen. Defender view: anomalous command execution modifying org.gnome.login-screen or other greeter configurations.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	auditd:FILE	Modification of Display Manager configuration files (/etc/gdm3/, /etc/lightdm/)
Command ExecutionDC0064	auditd:EXECVE	Execution of gsettings set org.gnome.login-screen disable-user-list true

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
DisplayManagerScope	Specify which Display Managers are in use to minimize noise.

AN1003 · macOS

User creation or modification via dscl with IsHidden=1, UID<500, or plist edits to com.apple.loginwindow Hide500Users flag. Defender view: correlation of hidden account attributes with login screen exclusion.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
User Account MetadataDC0013	macos:unifiedlog	Creation of user account with UID <500
File ModificationDC0061	macos:unifiedlog	Modification of /Library/Preferences/com.apple.loginwindow plist
Command ExecutionDC0064	macos:unifiedlog	Execution of dscl . create with IsHidden=1

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
UIDThreshold	Tune detection based on acceptable UID ranges for hidden/system accounts.
PlistScope	Restrict plist monitoring to com.apple.loginwindow to reduce false positives.

Operating System ConfigurationM1028

If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the /Library/Preferences/com.apple.loginwindow Hide500Users value will force all users to be visible.

Tests3Executorssh 2 · cmd 1Need elevation3 of 3Have prerequisites0Have cleanup3Platformsmacos, windows

Test

Platform

Executor

Elevation

Prereqs

Cleanup

Ref

Create Hidden User using UniqueID < 500

macos

Required

—

Yes

Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)

Input arguments

Name	Type	Default	Description
user_name	string	APT	username to add

Attack command

sudo dscl . -create /Users/#{user_name} UniqueID 333

Cleanup command

sudo dscl . -delete /Users/#{user_name}

GUID526c1bbb-66be-4034-8a08-061a56b142d2

Create Hidden User using IsHidden option

macos

Required

—

Yes

Add a hidden user on macOS using IsHidden optoin

Input arguments

Name	Type	Default	Description
user_name	string	APT	username to add

Attack command

sudo dscl . -create /Users/#{user_name} IsHidden 1

Cleanup command

sudo dscl . -delete /Users/#{user_name}

GUID34b9317c-fa45-49ec-9887-6e0194a1ddb0

Create Hidden User in Registry

windows

cmd

Required

—

Yes

Adversaries may similarly hide user accounts in Windows. Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen. Reference https://attack.mitre.org/techniques/T1564/002/ and https://thedfirreport.com/2022/07/11/select-xmrig-from-sqlserver/

Input arguments

Name	Type	Default	Description
user_name	string	AtomicOperator	Username
user_password	string	At0micRedTeam!	Password for new user account

Attack command

NET USER #{user_name}$ #{user_password} /ADD /expires:never 
REG ADD "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /t REG_DWORD /d 0

Cleanup command

reg delete "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" /v #{user_name}$ /f >nul 2>&1
net user ${user_name}$ /delete >nul 2>&1

GUIDea34f26d-ef61-4e62-af0f-341bb22c7c90

Tests from Atomic Red Team (MIT licence) · technique definition

Hidden Users detections T1564.002

4 rules are mapped to this technique. Parent techniques also include their sub-techniques’ rules. Click a slice or key entry to filter the table.

60th pctamong all ATT&CK techniques for number of rules

Product

Severity

Library

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs