macOS Local Groups Discovery via dscacheutil/cat/dscl Enumeration

Flags macOS process executions that enumerate local system groups using dscacheutil, cat, or dscl commands.

FreeUnreviewedSigmainformationalv1

macos-local-groups-discovery-via-dscacheutil-cat-dscl-enumeration-89bb1f97

title: macOS Local Groups Discovery via dscacheutil/cat/dscl Enumeration
id: 6d1a9f49-6568-42f3-b40b-4c5e494375a2
status: test
description: This rule identifies attempts to enumerate local system groups on macOS by observing process executions of dscacheutil, cat, and dscl with group- and group-file-specific command-line arguments. Attackers often perform this discovery to understand local user and group context for subsequent access attempts or privilege-related targeting. The detection relies on process creation telemetry, matching executable path suffixes and required command-line substrings.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1069.001/T1069.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_local_groups.yml
author: Ömer Günal, Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-11
modified: 2022-11-27
tags:
  - attack.discovery
  - attack.t1069.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_1:
    Image|endswith: /dscacheutil
    CommandLine|contains|all:
      - -q
      - group
  selection_2:
    Image|endswith: /cat
    CommandLine|contains: /etc/group
  selection_3:
    Image|endswith: /dscl
    CommandLine|contains|all:
      - -list
      - /groups
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 89bb1f97-c7b9-40e8-b52b-7d6afbd67276
    type: derived

What it detects

This rule identifies attempts to enumerate local system groups on macOS by observing process executions of dscacheutil, cat, and dscl with group- and group-file-specific command-line arguments. Attackers often perform this discovery to understand local user and group context for subsequent access attempts or privilege-related targeting. The detection relies on process creation telemetry, matching executable path suffixes and required command-line substrings.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.