Creation Of A Local User Account

Status: test
Severity: low
Log source: category process_creation, product macos
Author: Alejandro Ortuno, oscd.community
Source: github.com/SigmaHQ/sigma

Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1136.001` Create Account: Local Account

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Creation Of A Local User Account
id: 51719bf5-e4fd-4e44-8ba8-b830e7ac0731
status: test
description: Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
    - https://ss64.com/osx/sysadminctl.html
author: Alejandro Ortuno, oscd.community
date: 2020-10-06
modified: 2023-02-18
tags:
    - attack.t1136.001
    - attack.persistence
logsource:
    category: process_creation
    product: macos
detection:
    selection_dscl:
        Image|endswith: '/dscl'
        CommandLine|contains: 'create'
    selection_sysadminctl:
        Image|endswith: '/sysadminctl'
        CommandLine|contains: 'addUser'
    condition: 1 of selection_*
falsepositives:
    - Legitimate administration activities
level: low

Stages and Predicates

Stage 0: `condition`

1 of selection_*

Stage 1: `selection_dscl`

selection_dscl:
    Image|endswith: '/dscl'
    CommandLine|contains: 'create'

Stage 2: `selection_sysadminctl`

selection_sysadminctl:
    Image|endswith: '/sysadminctl'
    CommandLine|contains: 'addUser'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`addUser` `create`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/dscl` `/sysadminctl`	`field:"Image" kind:ends_with`