macOS firmwarepasswd Command-Line Manipulation
Alerts on firmwarepasswd usage on macOS indicating firmware password set, full, delete, or check actions.
FreeReviewedSigma · Medium · v2
- Product
- macos
- Category
- process_creation
- Author
- Austin Songer @austinsonger (SigmaHQ), DRL 1.1
- Published
- 2021-09-30
- Updated
- 2026-07-31
What it detects
This rule flags process executions of /usr/sbin/firmwarepasswd with command-line arguments associated with password management actions such as setting, full updates, deletion, or checks. Attackers may use firmware password manipulation to alter device security controls to persist access before the operating system loads. It relies on macOS process creation telemetry, specifically the executed image path and command-line contents of firmwarepasswd.
Reporting behind it
- github.comhttps://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml
- manpagez.comhttps://www.manpagez.com/man/8/firmwarepasswd/
- support.apple.comhttps://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-firmwarepasswd-password-manipulation-via-setpasswd-full-delete-check-7ed2c9f7
title: macOS firmwarepasswd Command-Line Manipulation
id: 02a9e3ae-a23a-4685-acba-ffe2999d945c
status: test
description: This rule flags process executions of /usr/sbin/firmwarepasswd with command-line arguments associated with password management actions such as setting, full updates, deletion, or checks. Attackers may use firmware password manipulation to alter device security controls to persist access before the operating system loads. It relies on macOS process creation telemetry, specifically the executed image path and command-line contents of firmwarepasswd.
references:
- https://github.com/usnistgov/macos_security/blob/932a51f3e819dd3e02ebfcf3ef433cfffafbe28b/rules/os/os_firmware_password_require.yaml
- https://www.manpagez.com/man/8/firmwarepasswd/
- https://support.apple.com/guide/security/firmware-password-protection-sec28382c9ca/web
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_macos_firmware_activity.yml
author: Austin Songer @austinsonger, Huntrule Team
date: 2021-09-30
modified: 2022-10-09
tags:
- attack.impact
logsource:
category: process_creation
product: macos
detection:
selection1:
Image: /usr/sbin/firmwarepasswd
CommandLine|contains:
- setpasswd
- full
- delete
- check
condition: selection1
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: 7ed2c9f7-c59d-4c82-a7e2-f859aa676099
type: derived