macOS: Guest account enabled via sysadminctl

Flags sysadminctl command lines that appear to activate the macOS guest account.

FreeReviewedSigma · Low · v2

Product: macos
Category: process_creation
Author: Sohan G (D4rkCiph3r) (SigmaHQ), DRL 1.1
Published: 2023-02-18
Updated: 2026-07-31

ATT&CK techniques

Initial Access → Defense Evasion

Recon
Resource Dev
Initial Access
- T1078Valid Accounts
- T1078.001Default Accounts
Execution
Persistence
- T1078Valid Accounts
- T1078.001Default Accounts
Priv Esc
- T1078Valid Accounts
- T1078.001Default Accounts
Defense Evasion
- T1078Valid Accounts
- T1078.001Default Accounts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process executions of the sysadminctl utility where the command line includes parameters to enable the guest account. Attackers may use the built-in guest account to establish an easy persistence or initial foothold without creating a new user. The detection relies on process creation telemetry, matching the sysadminctl executable path and specific command-line substrings associated with guest account activation.

Reporting behind it

Related detections9 linkedT1078 — drag to rearrange

macOS Root Account Enable Attempt via dsenableroot

Possible Next.js Middleware Auth Bypass via X-Middleware-Subrequest Header (CVE-2025-29927)

Suspicious Brutforce with Denied Access Due to Account Restrictions Policies (via security)

Suspicious Success Login Attempt on a Windows OpenSSH Server (via security)

Suspicious SQL Server - Connection Attempt Using a Disabled Account (via application)

Suspicious Lateral Movement Detection - Based on "special Groups" Feature (via security)

Suspicious Snowflake Anomalous Client Application Associated With UNC5537 (via cloud)

Malicious Network Login Performed to Multiple Targets (via security)

Malicious RDP Reconnaissance with Valid Credentials Performed on Multiple Hosts (via security)

macOS: Guest account enabled via sysadminctl

Pivot detection · T1078 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-sysadminctl-used-to-enable-guest-account-d7329412

title: "macOS: Guest account enabled via sysadminctl"
id: 0a31c67c-dee8-4db5-8415-5b0f7dd6b841
status: test
description: This rule flags process executions of the sysadminctl utility where the command line includes parameters to enable the guest account. Attackers may use the built-in guest account to establish an easy persistence or initial foothold without creating a new user. The detection relies on process creation telemetry, matching the sysadminctl executable path and specific command-line substrings associated with guest account activation.
references:
  - https://ss64.com/osx/sysadminctl.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml
author: Sohan G (D4rkCiph3r), Huntrule Team
date: 2023-02-18
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.initial-access
  - attack.stealth
  - attack.t1078
  - attack.t1078.001
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith: /sysadminctl
    CommandLine|contains|all:
      - " -guestAccount"
      - " on"
  condition: selection
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d7329412-13bd-44ba-a072-3387f804a106
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL