Defense Evasion - Hidden Users

User account in macOS has a userID associated with it. UserID can be specified when creating a user. A property value Hide500Users in /Library/Preferences/com.apple.loginwindow prevents users with userIDs 500 and lower from appearing at the login screen. Adversaries can Create Account with a userID under 500, enable this property and hide their user accounts by using following command:

sudo dscl . -create /Users/username UniqueID 401

Mitigation
Group policy
If the computer is domain joined, then group policy can help restrict the ability to create or hide users. Similarly, preventing the modification of the /Library/Preferences/com.apple.loginwindow Hide500Users value will force all users to be visible.

Detection
This technique prevents the new user from showing up at the log in screen, but all of the other signs of a new user still exist. The user still gets a home directory and will appear in the authentication logs.

Persistence Attack: Accessibility Feature

Accessibility features in Windows OS can be launched with a key combination before a user logs in. An attacker can modify the way these programs are launched to use services like Command Prompt or Backdoor without even logging into the system.

There are two most common accessibility programs 

• C:\Windows\System32\sethc.exe, launched when the shift key is pressed five times and 
• C:\Windows\System32\utilman.exe, launched when the Windows + U key combination is pressed. 

The sethc.exe is referred to as "sticky keys", and has been used by adversaries for unauthenticated access through a remote desktop login screen.

This feature can be used to maintain persistence and elevation of system privilege. This should, therefore, be monitored always.

Data Sources

Sysmon: Process and Registry Monitoring (event id 1, 12 and 13)Windows: Process Monitoring (event id 4688)

Logic:

process WHERE (parent_process_name = "setchc.exe" OR parent_process_name = "osk.exe" OR parent_process_name = "utilman.exe" OR parent_process_name = "Magnify.exe" OR parent_process_name = "DisplaySwitch.exe" OR parent_process_name = "AtBroker.exe") OR (process_name = "setchc.exe" OR process_name = "osk.exe" OR process_name = "utilman.exe" OR process_name = "Magnify.exe" OR process_name = "DisplaySwitch.exe" OR process_name = "AtBroker.exe") AND target_object CONTAINS ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options' AND 'Debugger')