macOS: Guest account enabled via sysadminctl

Flags sysadminctl command lines that appear to activate the macOS guest account.

FreeReviewedSigma · Low · v2

Product: macos
Category: process_creation
Author: Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
Published: 2023-02-18
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
- T1078.001Default Accounts
Execution
Persistence
- T1078Valid Accounts
- T1078.001Default Accounts
Priv Esc
- T1078Valid Accounts
- T1078.001Default Accounts
Defense Evasion
- T1078Valid Accounts
- T1078.001Default Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of the sysadminctl utility where the command line includes parameters to enable the guest account. Attackers may use the built-in guest account to establish an easy persistence or initial foothold without creating a new user. The detection relies on process creation telemetry, matching the sysadminctl executable path and specific command-line substrings associated with guest account activation.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

macOS Root Account Enable Attempt via dsenableroot

Suspicious SonicWall NetExtender VPN Command-Line Authentication with Always-Trust (via process_creation)

Suspicious Self-Hosted GitHub Actions Runner Started As Root via Shell (via process_creation)

Suspicious Guest Account Privilege Escalation (via process_creation)

Suspicious Login Shell Assigned to Service Account games on Linux

Suspicious SSH Daemon Configuration Change Enabling Root Login

Suspicious NTLM Network Logon From Attacker Controlled Workstation Names (via security)

Suspicious dMSA Object Access with Migration AccessMask

Malicious ESX Admins Group Added to Privileged Directory Group

macOS: Guest account enabled via sysadminctl

Pivot detection · T1078 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-sysadminctl-used-to-enable-guest-account-d7329412

title: "macOS: Guest account enabled via sysadminctl"
id: 0a31c67c-dee8-4db5-8415-5b0f7dd6b841
status: test
description: This rule flags process executions of the sysadminctl utility where the command line includes parameters to enable the guest account. Attackers may use the built-in guest account to establish an easy persistence or initial foothold without creating a new user. The detection relies on process creation telemetry, matching the sysadminctl executable path and specific command-line substrings associated with guest account activation.
references:
  - https://ss64.com/osx/sysadminctl.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.t1078.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /sysadminctl
    CommandLine|contains|all:
      - " -guestAccount"
      - " on"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d7329412-13bd-44ba-a072-3387f804a106
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL