Suspicious Hidden User Creation (via process_creation)

title: Suspicious Hidden User Creation (via process_creation)
id: d60a68fb-ee7e-53f2-8e4b-d99f91d642f9
status: stable
description: This rule detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
references:
    - https://attack.mitre.org/techniques/T1564/002/
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
author: Huntrule Team
date: 2026-03-24
tags:
    - attack.stealth
    - attack.t1564.002
logsource:
    category: process_creation
    product: macos
detection:
    dscl_create:
        Image|endswith: '/dscl'
        CommandLine|contains: 'create'
    id_below_500:
        CommandLine|contains: UniqueID
        CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'
    ishidden_option_declaration:
        CommandLine|contains: 'IsHidden'
    ishidden_option_confirmation:
        CommandLine|contains:
            - 'true'
            - 'yes'
            - '1'
    condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
falsepositives:
    - Unknown
level: medium