macOS Hidden User Creation via dscl (UniqueID < 500 or IsHidden=true)

title: macOS Hidden User Creation via dscl (UniqueID < 500 or IsHidden=true)
id: 56fb1f68-ecf4-4c4f-8a81-b85efd06956f
status: test
description: This rule flags macOS account provisioning activity where dscl is used to create a user with a low UniqueID (below 500) or where the user is explicitly marked hidden using the IsHidden option. Hidden accounts can help attackers maintain stealth and persistence while blending into normal system user listings. It relies on process creation telemetry for dscl commands and matches command-line content related to user creation, UniqueID values, and IsHidden settings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-10
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1564.002
logsource:
  category: process_creation
  product: macos
detection:
  dscl_create:
    Image|endswith: /dscl
    CommandLine|contains: create
  id_below_500:
    CommandLine|contains: UniqueID
    CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2})
  ishidden_option_declaration:
    CommandLine|contains: IsHidden
  ishidden_option_confirmation:
    CommandLine|contains:
      - "true"
      - yes
      - "1"
  condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: b22a5b36-2431-493a-8be1-0bae56c28ef3
    type: derived