From 57e131fe4ebd104bd9fee80aaf57415b2ed9534e Mon Sep 17 00:00:00 2001 From: frack113 <62423083+frack113@users.noreply.github.com> Date: Sun, 21 Aug 2022 07:39:17 +0200 Subject: [PATCH] Update registry_set_add_hidden_user.yml --- .../registry/registry_set/registry_set_add_hidden_user.yml | 5 +++-- 1 file changed, 3 insertions(+), 2 deletions(-) diff --git a/rules/windows/registry/registry_set/registry_set_add_hidden_user.yml b/rules/windows/registry/registry_set/registry_set_add_hidden_user.yml index ac6b74fa9..b8b5abaee 100644 --- a/rules/windows/registry/registry_set/registry_set_add_hidden_user.yml +++ b/rules/windows/registry/registry_set/registry_set_add_hidden_user.yml @@ -1,4 +1,4 @@ -title: Creation of a Hidden User Account by Registry +title: User account hidden by the registry id: 8a58209c-7ae6-4027-afb0-307a78e4589a description: Detect modification for a specific user to prevent that user from being listed on the logon screen status: experimental @@ -21,4 +21,5 @@ falsepositives: level: high tags: - attack.defense_evasion - - attack.t1564.002 \ No newline at end of file + - attack.t1564.002 +