Hidden local account
A local account whose name ends in $ was created in the SAM.
What it detects
A local account whose name ends in $ was created in the SAM. Windows treats a trailing $ as the machine-account convention, and net user omits such entries from its listing — so the account exists, can log on, and can hold administrator rights, while the most common way an administrator checks "who has an account on this box" does not show it.
There is no administrative reason to create a USER account named this way. The technique exists purely to survive the check that follows an incident.
MITRE ATT&CK mapping
False positives and triage
Genuine machine accounts also end in $, but they live in Active Directory, not in a member machine's local SAM — this key is the LOCAL account database, so a computer account has no business appearing here.
To confirm: enumerate local accounts with something that does not hide them — Get-LocalUser, wmic useraccount get name, or the SAM key itself — rather than net user. Check the account's group membership (it is frequently in Administrators), whether it has ever logged on, and when it was created relative to the rest of the timeline. Preserve the account before removing it; its creation time and the process that created it place the intrusion.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 85%. Source: rules/windows/hidden_local_account.yaml, licensed under the Apache License 2.0.
id: windows.persistence.hidden_local_account
version: 1.0.0
status: stable
severity: critical
confidence: 0.85
platforms: [windows]
mitre_techniques: [T1136.001, T1564.002]
description: |
A local account whose name ends in `$` was created in the SAM. Windows treats a
trailing `$` as the machine-account convention, and `net user` omits such entries
from its listing — so the account exists, can log on, and can hold administrator
rights, while the most common way an administrator checks "who has an account on
this box" does not show it.
There is no administrative reason to create a USER account named this way. The
technique exists purely to survive the check that follows an incident.
match:
registry_path_regex: '(?i)\\SAM\\SAM\\Domains\\Account\\Users\\Names\\[^\\]+\$'
correlation_keys: [hostname]
false_positive_guidance: |
Genuine machine accounts also end in `$`, but they live in Active Directory, not in
a member machine's local SAM — this key is the LOCAL account database, so a
computer account has no business appearing here.
To confirm: enumerate local accounts with something that does not hide them —
`Get-LocalUser`, `wmic useraccount get name`, or the SAM key itself — rather than
`net user`. Check the account's group membership (it is frequently in
Administrators), whether it has ever logged on, and when it was created relative to
the rest of the timeline. Preserve the account before removing it; its creation
time and the process that created it place the intrusion.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.