macOS User Account Manipulation

title: macOS User Account Manipulation
id: ae07466e-5964-418d-9f2f-dcaf405ac2fc
status: experimental
description: 'Detects creation, deletion, or modification of user accounts via Open
  Directory.

  Attackers often create backdoor accounts for persistence or modify existing

  accounts to maintain access. Monitor for unexpected user management activities.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1136/001/
- https://attack.mitre.org/techniques/T1098/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection:
    esf.event_type:
    - 141  # ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER
    - 142  # ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER
    - 143  # ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER
    - 144  # ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER
    - 148  # ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD
  condition: selection
falsepositives:
- IT administration and user provisioning
- MDM user management
- User self-service password changes
- Automated user lifecycle management
fields:
- event_type
- event_name
- User
- target_user
- ProcessId
tags:
- attack.persistence
- attack.t1136.001
- attack.t1098
level: high