macOS dseditgroup Used to Add User to admin Group
Flags dseditgroup command lines that edit and add a user to the macOS admin group.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-08-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of the dseditgroup utility on macOS where the command line indicates an edit operation adding a specified user to the admin group. Adding an account to the admin group grants elevated privileges, which can be used for persistence, privilege escalation, or stealthy access. The detection relies on process creation telemetry capturing the process image path and command-line arguments containing the relevant dseditgroup parameters.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos
- ss64.comhttps://ss64.com/osx/dseditgroup.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS dseditgroup Used to Add User to admin Group
id: 07fd3b78-fbb0-4e2a-a4f8-342345c1e1bd
status: test
description: This rule identifies process executions of the dseditgroup utility on macOS where the command line indicates an edit operation adding a specified user to the admin group. Adding an account to the admin group grants elevated privileges, which can be used for persistence, privilege escalation, or stealthy access. The detection relies on process creation telemetry capturing the process image path and command-line arguments containing the relevant dseditgroup parameters.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-5---add-a-newexisting-user-to-the-admin-group-using-dseditgroup-utility---macos
- https://ss64.com/osx/dseditgroup.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dseditgroup_add_to_admin_group.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-08-22
tags:
- attack.persistence
- attack.initial-access
- attack.privilege-escalation
- attack.stealth
- attack.t1078.003
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /dseditgroup
CommandLine|contains|all:
- " -o edit "
- " -a "
- " -t user"
- admin
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: 5d0fdb62-f225-42fb-8402-3dfe64da468a
type: derived