macOS: sysadminctl Used to Add User to Admin Group

title: "macOS: sysadminctl Used to Add User to Admin Group"
id: 4feea890-37fb-432d-b615-8659d3e774fd
related:
  - id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b
    type: obsolete
  - id: 652c098d-dc11-4ba6-8566-c20e89042f2b
    type: derived
status: test
description: This rule flags process executions of sysadminctl where the command line includes both " -addUser " and " -admin ", indicating an attempt to create/add an account with administrative privileges. Gaining admin group membership can enable persistence and further privilege escalation while potentially blending into legitimate administration workflows. Telemetry relies on macOS process creation events capturing the executable path and command-line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos
  - https://ss64.com/osx/sysadminctl.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-03-19
tags:
  - attack.persistence
  - attack.initial-access
  - attack.privilege-escalation
  - attack.stealth
  - attack.t1078.003
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /sysadminctl
    CommandLine|contains|all:
      - " -addUser "
      - " -admin "
  condition: selection
falsepositives:
  - Legitimate administration activities
level: medium
license: DRL-1.1