macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.002Hidden Users
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags macOS user account creation using the dscl utility when the command indicates a hidden account or a system-like UniqueID below 500. Hidden accounts and low UniqueIDs can help attackers reduce visibility and blend into host user management artifacts. The detection relies on process creation telemetry for dscl commands and matches command-line arguments containing create, UniqueID, and IsHidden values.

Reporting behind it

Related detections7 linkedT1564.002 — drag to rearrange

Suspicious Hidden Account Creation via Winlogon SpecialAccounts UserList Registry

Hiding local user accounts

Malicious Hidden Local Account via Winlogon SpecialAccounts UserList

Suspicious Hidden Local Account via SpecialAccounts UserList Registry Value (via registry_set)

Windows Process Creation: Suspicious secedit.exe Security Policy Export or Configuration

Windows Registry: Hidden User via Winlogon SpecialAccounts Userlist Value 0

Windows Process Creation: reg.exe Adds Winlogon SpecialAccounts Userlist Value 0

macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)

Pivot detection · T1564.002 · 7 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-hidden-user-creation-via-dscl-uniqueid-500-or-ishidden-true-b22a5b36

title: macOS Hidden User Creation via dscl (Hidden Account or UniqueID<500)
id: 56fb1f68-ecf4-4c4f-8a81-b85efd06956f
status: test
description: This rule flags macOS user account creation using the dscl utility when the command indicates a hidden account or a system-like UniqueID below 500. Hidden accounts and low UniqueIDs can help attackers reduce visibility and blend into host user management artifacts. The detection relies on process creation telemetry for dscl commands and matches command-line arguments containing create, UniqueID, and IsHidden values.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_hidden_account.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-10
modified: 2021-11-27
tags:
  - attack.stealth
  - attack.t1564.002
logsource:
  category: process_creation
  product: macos
detection:
  dscl_create:
    Image|endswith: /dscl
    CommandLine|contains: create
  id_below_500:
    CommandLine|contains: UniqueID
    CommandLine|re: ([0-9]|[1-9][0-9]|[1-4][0-9]{2})
  ishidden_option_declaration:
    CommandLine|contains: IsHidden
  ishidden_option_confirmation:
    CommandLine|contains:
      - "true"
      - yes
      - "1"
  condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1
related:
  - id: b22a5b36-2431-493a-8be1-0bae56c28ef3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL