Detection rules › Sigma
macOS User Account Manipulation
Detects creation, deletion, or modification of user accounts via Open Directory. Attackers often create backdoor accounts for persistence or modify existing accounts to maintain access. Monitor for unexpected user management activities.
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Persistence | T1098 Account Manipulation, T1136.001 Create Account: Local Account |
Rule body yaml
title: macOS User Account Manipulation
id: ae07466e-5964-418d-9f2f-dcaf405ac2fc
status: experimental
description: 'Detects creation, deletion, or modification of user accounts via Open
Directory.
Attackers often create backdoor accounts for persistence or modify existing
accounts to maintain access. Monitor for unexpected user management activities.
'
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1136/001/
- https://attack.mitre.org/techniques/T1098/
logsource:
product: macos
service: endpointsecurity
detection:
selection:
esf.event_type:
- 141 # ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER
- 142 # ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER
- 143 # ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER
- 144 # ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER
- 148 # ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD
condition: selection
falsepositives:
- IT administration and user provisioning
- MDM user management
- User self-service password changes
- Automated user lifecycle management
fields:
- event_type
- event_name
- User
- target_user
- ProcessId
tags:
- attack.persistence
- attack.t1136.001
- attack.t1098
level: high
Stages and Predicates
Stage 0: condition
selectionStage 1: selection
selection:
esf.event_type:
- 141
- 142
- 143
- 144
- 148
Indicators
Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.
| Field | Kind | Values |
|---|---|---|
esf.event_type | eq |
|