macOS Root Account Enable Attempt via dsenableroot

ATT&CK techniques

Initial Access → Defense Evasion

What it detects

This rule flags process executions of the macOS utility dsenableroot when invoked to enable the root account. Enabling a root account can provide attackers with persistent, high-privilege access and simplifies subsequent privilege escalation and stealth. The detection relies on process creation telemetry, matching the executable path ending in /dsenableroot.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

macOS: Guest account enabled via sysadminctl

Windows: Administrator Account Remote Logon via Negotiate (4624 LogonType 10)

Suspicious Hidden Account Creation via Winlogon SpecialAccounts UserList Registry

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Suspicious Brutforce with Denied Access Due to Account Restrictions Policies (via security)

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

Suspicious SQL Server - Connection Attempt Using a Disabled Account (via application)

Suspicious Lateral Movement Detection - Based on "special Groups" Feature (via security)

Suspicious Snowflake Anomalous Client Application Associated With UNC5537 (via cloud)

macOS Root Account Enable Attempt via dsenableroot

Pivot detection · T1078 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-root-account-enable-via-dsenableroot-821bcf4d

title: macOS Root Account Enable Attempt via dsenableroot
id: df795c16-be30-438e-bd65-e3f6ebfd5fa9
status: test
description: This rule flags process executions of the macOS utility dsenableroot when invoked to enable the root account. Enabling a root account can provide attackers with persistent, high-privilege access and simplifies subsequent privilege escalation and stealth. The detection relies on process creation telemetry, matching the executable path ending in /dsenableroot.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/b27a3cb25025161d49ac861cb216db68c46a3537/atomics/T1078.003/T1078.003.md
  - https://github.com/elastic/detection-rules/blob/4312d8c9583be524578a14fe6295c3370b9a9307/rules/macos/persistence_enable_root_account.toml
  - https://ss64.com/osx/dsenableroot.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_dsenableroot_enable_root_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-08-22
tags:
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078
  - attack.t1078.001
  - attack.t1078.003
  - attack.initial-access
  - attack.persistence
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /dsenableroot
  filter_main_disable:
    CommandLine|contains: " -d "
  condition: selection and not 1 of filter_main_*
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: 821bcf4d-46c7-4b87-bc57-9509d3ba7c11
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL