On Windows systems, identify any user account that was hidden by setting its value to 0 under the SpecialAccounts\\UserList registry key. What was the name of the hidden account?

DeviceRegistryEvents
| where RegistryKey endswith 'SpecialAccounts\\UserList'
| where RegistryValueData == '0'
| project HiddenAccountName = RegistryValueName, TimeGenerated, DeviceName

DeviceRegistryEvents
| where RegistryKey has "SpecialAccounts\\UserList"
    and RegistryValueData == "0"
    and (RegistryKey has "Winlogon" and RegistryKey has "Microsoft")
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData, InitiatingProcessAccountName, InitiatingProcessCommandLine
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey endswith "\\SpecialAccounts\\UserList"
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, AccountDomain = InitiatingProcessAccountDomain, HiddenUserAccount = RegistryValueName
| distinct TimeGenerated, DeviceName, AccountDomain, HiddenUserAccount
| order by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey has "SpecialAccounts\\UserList"
| where RegistryValueData == '0'
| project Timestamp, DeviceName, RegistryValueName, RegistryValueData, DeviceId

DeviceRegistryEvents
| where RegistryKey contains "SpecialAccounts\\UserList" and RegistryValueData == "0"
| project InitiatingProcessAccountName, RegistryKey, RegistryValueData

let HiddenUserChanges =
DeviceRegistryEvents
| where RegistryKey contains @"\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList"
| where ActionType in ("RegistryValueSet", "RegistryKeyCreated", "RegistryValueModified")
| extend ValueDataStr = tostring(RegistryValueData)
| extend IsZero = iif(tolong(ValueDataStr) == 0 or ValueDataStr matches regex @"(?i)^\s*(?:0x)?0+\s*(?:\((?:0x)?0+\))?\s*$", true, false)
| where IsZero
| project TimeGenerated, DeviceName, DeviceId, HiddenAccount=RegistryValueName, RegistryKey, RegistryValueData, PreviousRegistryValueData, ActionType,
          InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessSHA256;
// Detailed events (latest first)
HiddenUserChanges
| order by TimeGenerated desc

DeviceRegistryEvents
| where isnotempty(RegistryKey)
// Match both the direct SpecialAccounts path and under Policies\Explorer
| where RegistryKey has "SpecialAccounts\\UserList" or RegistryKey has "Policies\\Explorer\\SpecialAccounts\\UserList"
// Only care about entries where a named value (the account name) was written
| where isnotempty(RegistryValueName)
// Normalize RegistryValueData: trim, lowercase
| extend RVD = tolower(tostring(RegistryValueData))
// Recognize common zero representations: "0", "0x0", "dword:00000000" etc.
| where RVD in ("0", "0x0") or RVD has "dword:00000000" or toint(RVD) == 0
| extend HiddenAccount = RegistryValueName
| project TimeGenerated, DeviceName, DeviceId, InitiatingProcessAccountName, RegistryKey, RegistryValueName, RegistryValueData, ActionType, HiddenAccount
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), Count=count(), Devices=make_set(DeviceName), InitiatingAccounts=make_set(InitiatingProcessAccountName), RegistryKeys=make_set(RegistryKey), ActionTypes=make_set(ActionType) by HiddenAccount
| order by FirstSeen asc

let events = DeviceRegistryEvents
| where RegistryKey has "SpecialAccounts\\UserList"
| where isnotempty(RegistryValueName)
| extend rv = tostring(RegistryValueData)
// Match common zero representations: "0", "0x0", "dword:0..."
| where rv matches regex @"(?i)^\s*(?:0|0x0+|dword:0+)\s*$"
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, RegistryValueName, RegistryValueData = rv, ActionType, InitiatingProcessAccountName, InitiatingProcessCommandLine, ReportId;
// Show recent matching events
events
| order by TimeGenerated desc
| take 200

// Also show a summary of hidden account names
| union (
    events
    | summarize FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated), Occurrences = count() by RegistryValueName, RegistryKey
    | order by Occurrences desc
)

DeviceRegistryEvents
| where isnotempty(RegistryKey)
// Match common path variations case-insensitive
| where tolower(RegistryKey) matches regex ".*\\\b(winlogon)\\\b.*\\\b(specialaccounts)\\\b.*\\\b(userlist)\\\b.*" or tolower(RegistryKey) contains "specialaccounts" and tolower(RegistryKey) contains "userlist"
| where RegistryValueName != "" and RegistryValueName != "(Default)"
// Normalize RegistryValueData to string (trim quotes) and integer
| extend RVD_str = trim('"', tostring(RegistryValueData))
| extend RVD_int = toint(RVD_str)
// If original type is numeric, also try converting direct value
| where RVD_str == "0" or (isnotnull(RVD_int) and RVD_int == 0)
| extend HiddenAccount = RegistryValueName
| project TimeGenerated, DeviceName, DeviceId, HiddenAccount, RegistryKey, RegistryValueName, RegistryValueData, RegistryValueType, ActionType, InitiatingProcessAccountName, InitiatingProcessAccountDomain, InitiatingProcessFileName, InitiatingProcessCommandLine, InitiatingProcessId
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated), EventsCount=count(), Any_InitiatingProcessFileName=any(InitiatingProcessFileName), Any_InitiatingProcessAccount=any(InitiatingProcessAccountName) by DeviceName, DeviceId, HiddenAccount, RegistryKey
| order by LastSeen desc

DeviceRegistryEvents
| where tolower(RegistryKey) contains "winlogon" and tolower(RegistryKey) contains "specialaccounts" and tolower(RegistryKey) contains "userlist"
| extend ValueInt = toint(RegistryValueData)
| where isnotnull(ValueInt) and ValueInt == 0
| project TimeGenerated, DeviceName, DeviceId, RegistryKey, HiddenAccount = RegistryValueName, RegistryValueData
| sort by TimeGenerated desc

DeviceRegistryEvents
| where RegistryKey contains 'SpecialAccounts\\UserList'
| where RegistryValueData == '0'
| project DeviceName, Timestamp, RegistryKey, RegistryValueName, RegistryValueData
| order by Timestamp desc

DeviceRegistryEvents
| where RegistryKey has 'SpecialAccounts\\UserList' and RegistryValueData == '0'
| project HiddenAccount = RegistryValueName, Timestamp, DeviceName
| summarize HiddenAccounts = make_set(HiddenAccount) by DeviceName

DeviceRegistryEvents
| where ActionType in ("RegistryValueSet","RegistryValueModified","RegistryValueCreated")  // capture the creation or update of the registry value
| where RegistryKey has "\\SpecialAccounts\\UserList"  // only look at that specific registry location
| where tolower(RegistryValueData) == "0"  // hidden account when its value is set to 0
| project TimeGenerated, DeviceName, HiddenAccount = RegistryValueName, RegistryValueData, InitiatingProcessAccountName, ActionType

DeviceRegistryEvents
| where ActionType in ("ModifyValue", "SetValue", "RegistryValueSet")
| where RegistryKey has "SOFTWARE\\Microsoft\\Windows NT\\CurrentVersion\\Winlogon\\SpecialAccounts\\UserList"
| where RegistryValueData == "0"
| project TimeGenerated, DeviceName, HiddenAccount = RegistryValueName, InitiatingProcessAccountName

// Hidden local user accounts – registry value set to 0 under SpecialAccounts\UserList
DeviceRegistryEvents
| where RegistryKey has "\\SpecialAccounts\\UserList" 
| where ActionType in ("RegistryValueSet","RegistryValueModified","RegistryValueCreated","RegistryKeyValueWritten")
| where RegistryValueData == "0" or RegistryValueData == 0
| project TimeGenerated,
          DeviceName,
          HiddenAccount = RegistryValueName,
          RegistryKey,
          RegistryValueData,
          InitiatingProcessAccountDomain,
          InitiatingProcessAccountName,
          InitiatingProcessFileName,
          InitiatingProcessCommandLine
| summarize FirstSeen=min(TimeGenerated), LastSeen=max(TimeGenerated) by DeviceName, HiddenAccount, InitiatingProcessAccountDomain, InitiatingProcessAccountName, InitiatingProcessFileName
| order by LastSeen desc

DeviceRegistryEvents
| where RegistryKey contains "SpecialAccounts\\UserList"
| where RegistryValueData == "0"
| distinct RegistryValueName

DeviceRegistryEvents
| where RegistryKey has "SpecialAccounts\\UserList"
| where RegistryValueData == "0"
| distinct RegistryValueName
| project HiddenAccount=RegistryValueName