macOS sysadminctl Used to Enable Guest Account

title: macOS sysadminctl Used to Enable Guest Account
id: 0a31c67c-dee8-4db5-8415-5b0f7dd6b841
status: test
description: This rule identifies process executions of the macOS sysadminctl utility where the command line includes parameters consistent with enabling the guest account. Enabling a guest account can provide attackers a low-friction path to persistence or initial access with reduced barriers to authentication. The detection relies on process creation telemetry, matching the executed binary name and specific command-line fragments.
references:
  - https://ss64.com/osx/sysadminctl.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.t1078.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /sysadminctl
    CommandLine|contains|all:
      - " -guestAccount"
      - " on"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d7329412-13bd-44ba-a072-3387f804a106
    type: derived