Local System Accounts Discovery - MacOs

calendar Jul 8, 2026 · attack.discovery attack.t1087.001  ·
Share on: linkedin copy

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation.

Sigma rule (View on GitHub)

 1title: Local System Accounts Discovery - MacOs
 2id: ddf36b67-e872-4507-ab2e-46bda21b842c
 3status: test
 4description: |
 5    Detects enumeration of local system accounts on MacOS systems.
 6    This can be used by attackers to identify accounts for lateral movement or privilege escalation.    
 7references:
 8    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
 9    - https://ss64.com/osx/dscl.html
10    - https://ss64.com/mac/dscacheutil.html
11author: Alejandro Ortuno, oscd.community
12date: 2020-10-08
13modified: 2026-07-07
14tags:
15    - attack.discovery
16    - attack.t1087.001
17logsource:
18    category: process_creation
19    product: macos
20detection:
21    selection_dscl:
22        Image|endswith: '/dscl'
23        CommandLine|contains|all:
24            - 'list'
25            - '/users'
26    selection_dscacheutil:
27        Image|endswith: '/dscacheutil'
28        CommandLine|contains|all:
29            - '-q'
30            - 'user'
31    selection_root:
32        CommandLine|contains: '''*:0:'''
33    selection_passwd_sudo:
34        Image|endswith:
35            - '/cat'
36            - '/awk'
37            - '/grep'
38        CommandLine|contains:
39            - '/etc/passwd'
40            - '/etc/sudoers'
41    selection_id:
42        Image|endswith: '/id'
43    selection_lsof:
44        Image|endswith: '/lsof'
45        CommandLine|contains: '-u'
46    selection_logged_in_users:
47        Image|endswith:
48            - '/who'
49            - '/w'
50            - '/users'
51            - '/last'
52    selection_home_dir_listing:
53        Image|endswith: '/ls'
54        CommandLine|endswith:
55            - '/Users'
56            - "/Users'"
57            - '/Users"'
58    selection_loginwindow_prefs:
59        Image|endswith:
60            - '/defaults' # defaults read /Library/Preferences/com.apple.loginwindow
61            - '/plutil' # plutil -p /Library/Preferences/com.apple.loginwindow.plist
62        CommandLine|contains: 'com.apple.loginwindow'
63    condition: 1 of selection*
64falsepositives:
65    - Legitimate administration activities
66level: low

References

Related rules

to-top