macOS dscl Adds User to Admin Group via -append /Groups/admin GroupMembership
Flags dscl commands on macOS that append a user into the local admin group membership.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-03-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule detects macOS process executions where dscl is used with parameters that append a specified value to the /Groups/admin GroupMembership attribute. Such activity can grant administrative privileges to a newly created or existing account, supporting persistence and privilege escalation. Telemetry relies on process creation events capturing the process image name/path and command-line arguments including the -append, /Groups/admin, and GroupMembership components.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos
- ss64.comhttps://ss64.com/osx/dscl.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS dscl Adds User to Admin Group via -append /Groups/admin GroupMembership
id: d5a883e1-752e-4c19-9eb2-a67cc1482b96
related:
- id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b
type: obsolete
- id: b743623c-2776-40e0-87b1-682b975d0ca5
type: derived
status: test
description: This rule detects macOS process executions where dscl is used with parameters that append a specified value to the /Groups/admin GroupMembership attribute. Such activity can grant administrative privileges to a newly created or existing account, supporting persistence and privilege escalation. Telemetry relies on process creation events capturing the process image name/path and command-line arguments including the -append, /Groups/admin, and GroupMembership components.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-2---create-local-account-with-admin-privileges---macos
- https://ss64.com/osx/dscl.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dscl_add_user_to_admin_group.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-03-19
tags:
- attack.persistence
- attack.initial-access
- attack.privilege-escalation
- attack.stealth
- attack.t1078.003
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /dscl
CommandLine|contains|all:
- " -append "
- " /Groups/admin "
- " GroupMembership "
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1