AN1001
Analytic 1001
Windows
Registry modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList setting user visibility to 0, or creation of user accounts not shown on login screen. Defender view: correlation of account creation with registry edits that mark users hidden.
WinEventLog:Security
EventCode=4720
WinEventLog:Sysmon
EventCode=13, 14
[AccountScope]
Restrict monitoring to privileged or unexpected accounts.
[BaselineHiddenUsers]
Whitelist accounts that are intentionally hidden by administrators.
AN1002
Analytic 1002
Linux
Use of gsettings or direct Display Manager modifications to hide users from greeter login screen. Defender view: anomalous command execution modifying org.gnome.login-screen or other greeter configurations.
auditd:EXECVE
Execution of gsettings set org.gnome.login-screen disable-user-list true
auditd:FILE
Modification of Display Manager configuration files (/etc/gdm3/*, /etc/lightdm/*)
[DisplayManagerScope]
Specify which Display Managers are in use to minimize noise.
AN1003
Analytic 1003
macOS
User creation or modification via dscl with IsHidden=1, UID<500, or plist edits to com.apple.loginwindow Hide500Users flag. Defender view: correlation of hidden account attributes with login screen exclusion.
macos:unifiedlog
Execution of dscl . create with IsHidden=1
macos:unifiedlog
Modification of /Library/Preferences/com.apple.loginwindow plist
macos:unifiedlog
Creation of user account with UID <500
[UIDThreshold]
Tune detection based on acceptable UID ranges for hidden/system accounts.
[PlistScope]
Restrict plist monitoring to com.apple.loginwindow to reduce false positives.