macOS dseditgroup Used to Add a User to the admin Group

title: macOS dseditgroup Used to Add a User to the admin Group
id: 07fd3b78-fbb0-4e2a-a4f8-342345c1e1bd
status: test
description: This rule identifies process executions of dseditgroup that use edit mode to add a specified user to the admin group, granting elevated privileges. Attackers may use this behavior for persistence, privilege escalation, or stealthy access by modifying group membership. It relies on macOS process creation telemetry, matching the dseditgroup binary name and specific command-line parameters indicating an add-to-admin operation.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos
  - https://ss64.com/osx/dseditgroup.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-08-22
tags:
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /dseditgroup
    CommandLine|contains|all:
      - " -o edit "
      - " -a "
      - " -t user"
      - admin
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: 5d0fdb62-f225-42fb-8402-3dfe64da468a
    type: derived