huntrule

macOS Local System Account Discovery via dscl, dscacheutil, id, lsof, who, and related queries

Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.

FreeUnreviewedSigmalowv1
title: macOS Local System Account Discovery via dscl, dscacheutil, id, lsof, who, and related queries
id: ab5a141e-bcf5-4fff-9610-4bd4f1308e3f
status: test
description: This rule identifies macOS process executions that enumerate local system accounts by querying user databases and account-related system information. Such discovery activity can help an attacker identify valid accounts to support later credential access, lateral movement, or privilege escalation. The detection relies on process creation telemetry, matching command-line patterns for common account enumeration utilities and related flags/arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
  - https://ss64.com/osx/dscl.html
  - https://ss64.com/mac/dscacheutil.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_local_account.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2026-07-07
tags:
  - attack.discovery
  - attack.t1087.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_dscl:
    Image|endswith: /dscl
    CommandLine|contains|all:
      - list
      - /users
  selection_dscacheutil:
    Image|endswith: /dscacheutil
    CommandLine|contains|all:
      - -q
      - user
  selection_root:
    CommandLine|contains: "'*:0:'"
  selection_passwd_sudo:
    Image|endswith:
      - /cat
      - /awk
      - /grep
    CommandLine|contains:
      - /etc/passwd
      - /etc/sudoers
  selection_id:
    Image|endswith: /id
  selection_lsof:
    Image|endswith: /lsof
    CommandLine|contains: -u
  selection_logged_in_users:
    Image|endswith:
      - /who
      - /w
      - /users
      - /last
  selection_home_dir_listing:
    Image|endswith: /ls
    CommandLine|endswith:
      - /Users
      - /Users'
      - /Users"
  selection_loginwindow_prefs:
    Image|endswith:
      - /defaults
      - /plutil
    CommandLine|contains: com.apple.loginwindow
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: ddf36b67-e872-4507-ab2e-46bda21b842c
    type: derived

What it detects

This rule identifies macOS process executions that enumerate local system accounts by querying user databases and account-related system information. Such discovery activity can help an attacker identify valid accounts to support later credential access, lateral movement, or privilege escalation. The detection relies on process creation telemetry, matching command-line patterns for common account enumeration utilities and related flags/arguments.

Known false positives

  • Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.