macOS Root Account Enable via dsenableroot

title: macOS Root Account Enable via dsenableroot
id: df795c16-be30-438e-bd65-e3f6ebfd5fa9
status: test
description: This rule flags process executions on macOS where the binary path ends with '/dsenableroot', indicating an attempt to enable the root account. Enabling root is a high-impact step that can improve attacker capability for persistence and privilege escalation. The detection relies on process creation telemetry, matching the executed image path and applying a command-line filter that excludes cases containing ' -d '.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
  - https://ss64.com/osx/dsenableroot.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-08-22
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
  - attack.t1078.001
  - attack.t1078.003
  - attack.initial-access
  - attack.persistence
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /dsenableroot
  filter_main_disable:
    CommandLine|contains: " -d "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
    type: derived