Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1564.002sub-technique of T1564 Hide Artifacts

Hidden Users

Linux · macOS · Windowsnothing on this site yetT1564.002 on attack.mitre.org

Adversaries may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users. In macOS, adversaries can create or modify a user to be hidden through manipulating plist files, folder attributes, and user attributes.

MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Hidden User Accounts

  • Registry modifications to HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList setting user visibility to 0, or creation of user accounts not shown on login screen. Defender view: correlation of account creation with registry edits that mark users hidden.
  • Use of gsettings or direct Display Manager modifications to hide users from greeter login screen. Defender view: anomalous command execution modifying org.gnome.login-screen or other greeter configurations.
  • User creation or modification via dscl with IsHidden=1, UID<500, or plist edits to com.apple.loginwindow Hide500Users flag. Defender view: correlation of hidden account attributes with login screen exclusion.

what reduces it

  • M1028 Operating System Configuration. If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the `/Library/Preferences/com.apple.loginwindow` `Hide500Users` value will force all users to be visible.

the rest of T1564

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.