macOS Local User Account Creation via dscl or sysadminctl

Flags macOS commands (dscl create or sysadminctl addUser) that add local user accounts for persistence.

FreeUnreviewedSigmalowv1

macos-local-user-account-creation-via-dscl-or-sysadminctl-51719bf5

title: macOS Local User Account Creation via dscl or sysadminctl
id: d32b9986-24dc-4ebc-80e9-d40b7e81e8ab
status: test
description: This rule identifies the creation of a local user account on macOS by matching process execution of dscl with the create operation or sysadminctl with addUser. Attackers can use local accounts for persistence without needing external remote access tooling. Telemetry relies on process creation events that include the executable path and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
  - https://ss64.com/osx/sysadminctl.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml
author: Alejandro Ortuno, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2023-02-18
tags:
  - attack.t1136.001
  - attack.persistence
logsource:
  category: process_creation
  product: macos
detection:
  selection_dscl:
    Image|endswith: /dscl
    CommandLine|contains: create
  selection_sysadminctl:
    Image|endswith: /sysadminctl
    CommandLine|contains: addUser
  condition: 1 of selection_*
falsepositives:
  - Legitimate administration activities
level: low
license: DRL-1.1
related:
  - id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
    type: derived

What it detects

This rule identifies the creation of a local user account on macOS by matching process execution of dscl with the create operation or sysadminctl with addUser. Attackers can use local accounts for persistence without needing external remote access tooling. Telemetry relies on process creation events that include the executable path and command-line arguments.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.