Detection rules › Sigma

macOS User Account Manipulation

Status
experimental
Severity
high
Log source
product macos, service endpointsecurity
Author
Eric Brown - Nebulock, Inc.
Source
github.com/Nebulock-Inc/macos-coresigma

Detects creation, deletion, or modification of user accounts via Open Directory. Attackers often create backdoor accounts for persistence or modify existing accounts to maintain access. Monitor for unexpected user management activities.

MITRE ATT&CK coverage

Rule body yaml

title: macOS User Account Manipulation
id: ae07466e-5964-418d-9f2f-dcaf405ac2fc
status: experimental
description: 'Detects creation, deletion, or modification of user accounts via Open
  Directory.

  Attackers often create backdoor accounts for persistence or modify existing

  accounts to maintain access. Monitor for unexpected user management activities.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1136/001/
- https://attack.mitre.org/techniques/T1098/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection:
    esf.event_type:
    - 141  # ES_EVENT_TYPE_NOTIFY_OD_CREATE_USER
    - 142  # ES_EVENT_TYPE_NOTIFY_OD_DELETE_USER
    - 143  # ES_EVENT_TYPE_NOTIFY_OD_DISABLE_USER
    - 144  # ES_EVENT_TYPE_NOTIFY_OD_ENABLE_USER
    - 148  # ES_EVENT_TYPE_NOTIFY_OD_MODIFY_PASSWORD
  condition: selection
falsepositives:
- IT administration and user provisioning
- MDM user management
- User self-service password changes
- Automated user lifecycle management
fields:
- event_type
- event_name
- User
- target_user
- ProcessId
tags:
- attack.persistence
- attack.t1136.001
- attack.t1098
level: high

Stages and Predicates

Stage 0: condition

selection

Stage 1: selection

selection:
  esf.event_type:
  - 141
  - 142
  - 143
  - 144
  - 148

Indicators

Each row is a field, operator, and value that the rule matches. The corpus column counts how many other rules in the catalog look for the same combination: high numbers point to widely-used, community-vetted indicators. Blank or 1 shows that the indicator is specific to this rule.

FieldKindValues
esf.event_typeeq
  • 141
  • 142
  • 143
  • 144
  • 148