Sigma rule: Local System Accounts Discovery - MacOs

Rule

Title

Local System Accounts Discovery - MacOs

Status

test

Level

low

Author

Alejandro Ortuno, oscd.community

Date

2020-10-08

Modified

2026-07-07

File

rules/macos/process_creation/proc_creation_macos_local_account.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects enumeration of local system accounts on MacOS systems.
This can be used by attackers to identify accounts for lateral movement or privilege escalation.

Log source

product

macos

category

process_creation

Detection

selection_dscl:
    Image|endswith: '/dscl'
    CommandLine|contains|all:
        - 'list'
        - '/users'
selection_dscacheutil:
    Image|endswith: '/dscacheutil'
    CommandLine|contains|all:
        - '-q'
        - 'user'
selection_root:
    CommandLine|contains: '''*:0:'''
selection_passwd_sudo:
    Image|endswith:
        - '/cat'
        - '/awk'
        - '/grep'
    CommandLine|contains:
        - '/etc/passwd'
        - '/etc/sudoers'
selection_id:
    Image|endswith: '/id'
selection_lsof:
    Image|endswith: '/lsof'
    CommandLine|contains: '-u'
selection_logged_in_users:
    Image|endswith:
        - '/who'
        - '/w'
        - '/users'
        - '/last'
selection_home_dir_listing:
    Image|endswith: '/ls'
    CommandLine|endswith:
        - '/Users'
        - "/Users'"
        - '/Users"'
selection_loginwindow_prefs:
    Image|endswith:
        - '/defaults' # defaults read /Library/Preferences/com.apple.loginwindow
        - '/plutil' # plutil -p /Library/Preferences/com.apple.loginwindow.plist
    CommandLine|contains: 'com.apple.loginwindow'
condition: 1 of selection*

False positives (as the rule lists them)

• Legitimate administration activities

Tags

• attack.discovery
• attack.t1087.001

MITRE ATT&CK ids this rule names

• T1087.001

References

• https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
• https://ss64.com/osx/dscl.html
• https://ss64.com/mac/dscacheutil.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_local_account.yml