huntrule

macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands

Detects macOS commands used to enumerate local system accounts via dscl, dscacheutil, id, lsof, who, and preference/query utilities.

FreeReviewedSigma · Low · v2
Product
macos
Category
process_creation
Author
Alejandro Ortuno, oscd.community (SigmaHQ), DRL 1.1
Published
2020-10-08
Updated
2026-07-31
AnalysisDetection
title: macOS Local System Account Enumeration via dscl, dscacheutil, and user listing commands
id: ab5a141e-bcf5-4fff-9610-4bd4f1308e3f
status: test
description: This rule identifies process executions on macOS used to enumerate local system accounts by matching common account discovery utilities and arguments. Such enumeration can help attackers gather valid usernames to support lateral movement or privilege escalation. It relies on process creation telemetry including the executed binary path and command-line arguments for utilities like dscl, dscacheutil, id, who/w, lsof, cat/awk/grep against passwd/sudoers, and related listing/defaults commands.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
  - https://ss64.com/osx/dscl.html
  - https://ss64.com/mac/dscacheutil.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_local_account.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-08
modified: 2026-07-07
tags:
  - attack.discovery
  - attack.t1087.001
logsource:
  category: process_creation
  product: macos
detection:
  selection_dscl:
    Image|endswith: /dscl
    CommandLine|contains|all:
      - list
      - /users
  selection_dscacheutil:
    Image|endswith: /dscacheutil
    CommandLine|contains|all:
      - -q
      - user
  selection_root:
    CommandLine|contains: "'*:0:'"
  selection_passwd_sudo:
    Image|endswith:
      - /cat
      - /awk
      - /grep
    CommandLine|contains:
      - /etc/passwd
      - /etc/sudoers
  selection_id:
    Image|endswith: /id
  selection_lsof:
    Image|endswith: /lsof
    CommandLine|contains: -u
  selection_logged_in_users:
    Image|endswith:
      - /who
      - /w
      - /users
      - /last
  selection_home_dir_listing:
    Image|endswith: /ls
    CommandLine|endswith:
      - /Users
      - /Users'
      - /Users"
  selection_loginwindow_prefs:
    Image|endswith:
      - /defaults
      - /plutil
    CommandLine|contains: com.apple.loginwindow
  condition: 1 of selection*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: ddf36b67-e872-4507-ab2e-46bda21b842c
    type: derived