macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.
- Product
- macos
- Category
- process_creation
- Author
- Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-08
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions on macOS used to enumerate local system accounts by matching common account discovery utilities and arguments. Such enumeration can help attackers gather valid usernames to support lateral movement or privilege escalation. It relies on process creation telemetry including the executed binary path and command-line arguments for utilities like dscl, dscacheutil, id, who/w, lsof, cat/awk/grep against passwd/sudoers, and related listing/defaults commands.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
- ss64.comhttps://ss64.com/osx/dscl.html
- ss64.comhttps://ss64.com/mac/dscacheutil.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_local_account.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
id: ab5a141e-bcf5-4fff-9610-4bd4f1308e3f
status: test
description: This rule identifies process executions on macOS used to enumerate local system accounts by matching common account discovery utilities and arguments. Such enumeration can help attackers gather valid usernames to support lateral movement or privilege escalation. It relies on process creation telemetry including the executed binary path and command-line arguments for utilities like dscl, dscacheutil, id, who/w, lsof, cat/awk/grep against passwd/sudoers, and related listing/defaults commands.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
- https://ss64.com/osx/dscl.html
- https://ss64.com/mac/dscacheutil.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_local_account.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2026-07-07
tags:
- attack.discovery
- attack.t1087.001
logsource:
category: process_creation
product: macos
detection:
selection_dscl:
Image|endswith: /dscl
CommandLine|contains|all:
- list
- /users
selection_dscacheutil:
Image|endswith: /dscacheutil
CommandLine|contains|all:
- -q
- user
selection_root:
CommandLine|contains: "'*:0:'"
selection_passwd_sudo:
Image|endswith:
- /cat
- /awk
- /grep
CommandLine|contains:
- /etc/passwd
- /etc/sudoers
selection_id:
Image|endswith: /id
selection_lsof:
Image|endswith: /lsof
CommandLine|contains: -u
selection_logged_in_users:
Image|endswith:
- /who
- /w
- /users
- /last
selection_home_dir_listing:
Image|endswith: /ls
CommandLine|endswith:
- /Users
- /Users'
- /Users"
selection_loginwindow_prefs:
Image|endswith:
- /defaults
- /plutil
CommandLine|contains: com.apple.loginwindow
condition: 1 of selection*
falsepositives:
- Legitimate administration activities
level: low
license: DRL-1.1
related:
- id: ddf36b67-e872-4507-ab2e-46bda21b842c
type: derived