Threat Actors may use hidden users to hide the presence of user accounts they create or modify. Administrators may want to hide users when there are many user accounts on a given system or if they want to hide their administrative or other management accounts from other users.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.