macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)
Detects dscl commands on macOS creating hidden users (UniqueID < 500 or IsHidden true).
- Product
- macos
- Category
- process_creation
- Author
- Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-10
- Updated
- 2026-07-31
ATT&CK techniques
Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS user account creation using the dscl utility when the command indicates a hidden account or a system-like UniqueID below 500. Hidden accounts and low UniqueIDs can help attackers reduce visibility and blend into host user management artifacts. The detection relies on process creation telemetry for dscl commands and matches command-line arguments containing create, UniqueID, and IsHidden values.
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)
id: 56fb1f68-ecf4-4c4f-8a81-b85efd06956f
status: test
description: This rule flags macOS user account creation using the dscl utility when the command indicates a hidden account or a system-like UniqueID below 500. Hidden accounts and low UniqueIDs can help attackers reduce visibility and blend into host user management artifacts. The detection relies on process creation telemetry for dscl commands and matches command-line arguments containing create, UniqueID, and IsHidden values.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-10
modified: 2021-11-27
tags:
- attack.stealth
- attack.t1564.002
logsource:
category: process_creation
product: macos
detection:
dscl_create:
Image|endswith: /dscl
CommandLine|contains: create
id_below_500:
CommandLine|contains: UniqueID
CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2})
ishidden_option_declaration:
CommandLine|contains: IsHidden
ishidden_option_confirmation:
CommandLine|contains:
- "true"
- yes
- "1"
condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1
related:
- id: b22a5b36-2431-493a-8be1-0bae56c28ef3
type: derived