macOS Root Account Enable Attempt via dsenableroot
Detects macOS attempts to enable the root account by running /dsenableroot.
FreeReviewedSigma · Medium · v2
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-08-22
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Execution
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags process executions of the macOS utility dsenableroot when invoked to enable the root account. Enabling a root account can provide attackers with persistent, high-privilege access and simplifies subsequent privilege escalation and stealth. The detection relies on process creation telemetry, matching the executable path ending in /dsenableroot.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
- github.comhttps://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
- ss64.comhttps://ss64.com/osx/dsenableroot.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-root-account-enable-via-dsenableroot-821bcf4d
title: macOS Root Account Enable Attempt via dsenableroot
id: df795c16-be30-438e-bd65-e3f6ebfd5fa9
status: test
description: This rule flags process executions of the macOS utility dsenableroot when invoked to enable the root account. Enabling a root account can provide attackers with persistent, high-privilege access and simplifies subsequent privilege escalation and stealth. The detection relies on process creation telemetry, matching the executable path ending in /dsenableroot.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
- https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
- https://ss64.com/osx/dsenableroot.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-08-22
tags:
- attack.privilege-escalation
- attack.stealth
- attack.t1078
- attack.t1078.001
- attack.t1078.003
- attack.initial-access
- attack.persistence
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /dsenableroot
filter_main_disable:
CommandLine|contains: " -d "
condition: selection and not 1 of filter_main_*
falsepositives:
- Unknown
level: medium
license: DRL-1.1
related:
- id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
type: derived