TA0005 · DEFENSE EVASION
Hidden Users
Adversaries may use hidden users to hide the presence of user accounts they create or modify.
Detect it with
Monitor for users that may be hidden from the login screen but still present in additional artifacts of usage such as directories and authentication logs.
Why it matters on shift
Hidden Users is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context