Loading skill
Install any skill in seconds. Free to start, no credit card required.
Get Started Free →cyberstrikeus/T1564.002_hidden-users
Adversaries may use hidden users to hide the presence of user accounts they create or modify.
Passed 20 of 22 test cases with the skill, and 19 of 22 without it.
1 fixed19 passed either way2 still failing0 broke
Tokens, turns and time describe resource use, not a dollar price.
A test case the skill fixed. Same model, same prompt, with and without the skill.
What sequence of Windows command-line commands creates a hidden local user account named 'testuser$' that never expires and configures the Winlogon registry key to hide it?
| Checked | Without skill | With skill |
|---|---|---|
| Includes the NET USER testuser$ command with the /expires:never flag. | Missed | Passed |
| Includes the REG ADD command targetting SpecialAccounts\Userlist with DWORD value 0. | Passed | Passed |
The instructions your model reads when the skill loads.
Sub-technique of: T1564
Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes. To prevent a user from being shown on the login screen and in System Preferences, adversaries can set the userID to be under 500 and set the key value Hide500Users to TRUE in the /Library/Preferences/com.apple.loginwindow plist file. Every user has a userID associated with it. When the Hide500Users key value is set to TRUE, users with a userID under 500 do not appear on the login screen and in System Preferences. Using the command line, adversaries can use the dscl utility to create hidden user accounts by setting the IsHidden attribute to 1. Adversaries can also hide a user’s home folder by changing the chflags to hidden.
Adversaries may similarly hide user accounts in Windows. Adversaries can set the HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList Registry key value to 0 for a specific user to prevent that user from being listed on the logon screen.
On Linux systems, adversaries may hide user accounts from the login screen, also referred to as the greeter. The method an adversary may use depends on which Display Manager the distribution is currently using. For example, on an Ubuntu system using the GNOME Display Manger (GDM), accounts may be hidden from the greeter using the gsettings command (ex: sudo -u gdm gsettings set org.gnome.login-screen disable-user-list true). Display Managers are not anchored to specific distributions and may be changed by a user or adversary.
Platforms: macOS, Windows, Linux
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)
Supported Platforms: macos
test cases passed, vs 19 / 22 without
More skills from the same source and nearby in the registry, with their headline benchmark lift.