Creation Of A Local User Account
Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
Sigma rule (View on GitHub)
1title: Creation Of A Local User Account
2id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
3status: test
4description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
5references:
6 - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
7 - https://ss64.com/osx/sysadminctl.html
8author: Alejandro Ortuno, oscd.community
9date: 2020/10/06
10modified: 2023/02/18
11tags:
12 - attack.t1136.001
13 - attack.persistence
14logsource:
15 category: process_creation
16 product: macos
17detection:
18 selection_dscl:
19 Image|endswith: '/dscl'
20 CommandLine|contains: 'create'
21 selection_sysadminctl:
22 Image|endswith: '/sysadminctl'
23 CommandLine|contains: 'addUser'
24 condition: 1 of selection_*
25falsepositives:
26 - Legitimate administration activities
27level: low
References
-
Small and highly portable detection tests based on MITRE's ATT&CK. - redcanaryco/atomic-red-team
Read More -
sysadminctl Administer system user accounts. sysadminctl can be used to change user passwords, create new users (including automatically provisioning the user home folder) or to check the status of...
Read More
Related rules
- Cisco Local Accounts
- PowerShell Create Local User
- Creation Of An User Account
- Suspicious Windows ANONYMOUS LOGON Local Account Created
- Powerup Write Hijack DLL