macOS sysadminctl Used to Add User to Admin Group
Alerts when sysadminctl is used with -addUser and -admin to add a user to the macOS admin group.
- Product
- macos
- Category
- process_creation
- Author
- Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
- Published
- 2023-03-19
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → Defense EvasionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies process executions of sysadminctl on macOS where the command line includes both user addition and the admin flag. Attackers can use this to create or modify accounts with administrative privileges, enabling persistence and further privilege escalation. Telemetry relies on process creation events that include the process image path and full command line arguments.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos
- ss64.comhttps://ss64.com/osx/sysadminctl.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS sysadminctl Used to Add User to Admin Group
id: 4feea890-37fb-432d-b615-8659d3e774fd
related:
- id: 0c1ffcf9-efa9-436e-ab68-23a9496ebf5b
type: obsolete
- id: 652c098d-dc11-4ba6-8566-c20e89042f2b
type: derived
status: test
description: This rule identifies process executions of sysadminctl on macOS where the command line includes both user addition and the admin flag. Attackers can use this to create or modify accounts with administrative privileges, enabling persistence and further privilege escalation. Telemetry relies on process creation events that include the process image path and full command line arguments.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1078.003/T1078.003.md#atomic-test-3---create-local-account-with-admin-privileges-using-sysadminctl-utility---macos
- https://ss64.com/osx/sysadminctl.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-03-19
tags:
- attack.persistence
- attack.initial-access
- attack.privilege-escalation
- attack.stealth
- attack.t1078.003
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /sysadminctl
CommandLine|contains|all:
- " -addUser "
- " -admin "
condition: selection
falsepositives:
- Legitimate administration activities
level: medium
license: DRL-1.1