CmdID

CmdID / Techniques / T1564

T1564.002 Hide Artifacts: Hidden Users

Adversaries may use hidden users to hide the presence of user accounts they create or modify. MITRE ATT&CK

1 program on CmdID 3 Sigma rules T1564.002 on attack.mitre.org

Part of

MITRE ATT&CK
T1564Hide Artifacts

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules
reg.exeits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first
mediumHidden User CreationDaniil Yugoslavskiy, oscd.community · macOS
mediumHiding User Account Via SpecialAccounts Registry Key - CommandLine@Kostastsale, TheDFIRReport · Windows
mediumPotential Suspicious Activity Using SeCEditJanantha Marasinghe · Windows

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

To incorporate changes required by the analysis process on the SecContoso.inf file, and then to direct the output to the existing file, SecAnalysisContosoFY11, without prompting, type on the page for secedit configure

secedit /configure /db C:\Security\FY11\SecDbContoso.sdb /cfg SecContoso.inf /overwrite /log C:\Security\FY11\SecAnalysisContosoFY11.xml /quietIdentify

To export the security database and the domain security policies to an inf file, and then import that file to a different database in order to replicate the security policy settings on another computer, type on the page for secedit export

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

To export the security database and the domain security policies to an .inf file, and then to import that file to a different database to replicate the policy settings on another computer, type on the page for secedit import

secedit /export /db C:\Security\FY11\SecDbContoso.sdb /mergedpolicy /cfg NetworkShare\Policies\SecContoso.inf /log C:\Security\FY11\SecAnalysisContosoFY11.log /quietIdentify

An example is here when CmdID’s reading of it names T1564.002: a Sigma rule it trips is tagged with it, or its abuse is documented as it.