Full Report
Threat actors are enabling the built-in Windows Guest account to maintain persistence. Learn how they gain access and how to detect this activity.
Analysis Summary
# Tool/Technique: Built-in Guest Account Manipulation
## Overview
Threat actors are increasingly enabling the default Windows "Guest" account to maintain stealthy persistence within a compromised environment. Because the account is a legitimate, built-in part of the Windows Operating System (typically disabled by default), its activation often bypasses standard security alerts that might trigger upon the creation of a brand-new, strangely named user account.
## Technical Details
- **Type:** Technique (Persistence / Privilege Escalation)
- **Platform:** Windows (Workstations and Servers)
- **Capabilities:** Persistence, Remote Access, Privilege Escalation
- **First Seen:** Observed increase in activity starting early 2025
## MITRE ATT&CK Mapping
- **[TA0003 - Persistence]**
- **[T1078.003 - Valid Accounts: Local Accounts]**
- **[TA0004 - Privilege Escalation]**
- **[T1098 - Account Manipulation]**
- **[TA0008 - Lateral Movement]**
- **[T1021.001 - Remote Services: Remote Desktop Protocol]**
- **[TA0005 - Defense Evasion]**
- **[T1564.001 - Hide Artifacts: Hidden Files and Directories]** (via `attrib.exe`)
## Functionality
### Core Capabilities
- **Account Activation:** Using native Windows commands to enable the disabled-by-default Guest account.
- **Credential Control:** Assigning a specific password to the Guest account to allow threat actor authentication.
- **Remote Access:** Enabling Remote Desktop Protocol (RDP) and adding the Guest account to the "Remote Desktop Users" group.
### Advanced Features
- **Privilege Escalation:** Adding the Guest account to the "Local Administrators" group to gain full control over the endpoint.
- **Living off the Land (LotL):** Utilizing `net.exe` and `wmic.exe` to modify account attributes (e.g., setting `passwordexpires=false`) to ensure the persistence remains viable long-term.
- **Concealment:** In some cases, actors create secondary accounts (e.g., `DefaultAcount`) and use `attrib.exe` to hide user profile folders from the UI.
## Indicators of Compromise
- **File Names:** `net.exe`, `wmic.exe`, `attrib.exe` (when used for account manipulation).
- **Registry Keys:**
- `HKLM\SAM\SAM\Domains\Account\Users` (Modifications to the Guest RID).
- `HKLM\System\CurrentControlSet\Control\Terminal Server\fDenyTSConnections` (Set to 0 to enable RDP).
- **Behavioral Indicators:**
- Command line execution: `net user Guest /active:yes`
- Command line execution: `net localgroup Administrators Guest /add`
- Command line execution: `wmic useraccount where "name='Guest'" set passwordexpires=false`
- Use of `attrib.exe` to hide folders in `C:\Users\`.
## Associated Threat Actors
- **Unspecified/General:** Observed in multiple incidents since early 2025; often associated with actors deploying tools like **AnyDesk** and performing RDP-based lateral movement.
## Detection Methods
- **Behavioral Detection:** Monitor EDR for any execution of `net user` or `PowerShell` (e.g., `Enable-LocalUser`) targeting the "Guest" account.
- **Event Log Monitoring:**
- **Event ID 4722:** A user account was enabled (specifically where the Target Account Name is "Guest").
- **Event ID 4732:** A member was added to a security-enabled local group (Administrators).
- **Threat Hunting:** Regularly query the status of the local Guest account across all endpoints; it should remain disabled in almost all enterprise environments.
## Mitigation Strategies
- **Prevention:** Use Group Policy Objects (GPO) to explicitly disable the Guest account and ensure it cannot be added to sensitive groups.
- **Hardening:** Implement "Deny log on through Remote Desktop Services" and "Deny log on locally" for the Guest account via GPO.
- **Access Control:** Restrict the use of native tools like `wmic.exe` and `net.exe` to administrative users only, and alert on their usage by non-standard processes.
## Related Tools/Techniques
- **RID Hijacking:** A similar technique where the Relative Identifier (RID) of a guest account is modified to match an administrative account.
- **AnyDesk:** Frequently installed by actors alongside this technique to provide a secondary remote access vector.