Hidden local account creation via SpecialAccounts UserList registry key
Detects the creation of a local user account followed by the modification of the Winlogon SpecialAccounts\UserList registry key to hide the account from the Windows logon UI. This behavior is indicative of persistent access maintenance by adversaries, such as the Andariel threat group.
Microsoft Sentinel (KQL)
