Hidden User Creation

Status: test
Severity: medium
Log source: category process_creation, product macos
Author: Daniil Yugoslavskiy, oscd.community
Source: github.com/SigmaHQ/sigma

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Known false positives

Legitimate administration activities

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.002` Hide Artifacts: Hidden Users

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Hidden User Creation
id: b22a5b36-2431-493a-8be1-0bae56c28ef3
status: test
description: Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
author: Daniil Yugoslavskiy, oscd.community
date: 2020-10-10
modified: 2021-11-27
tags:
    - attack.stealth
    - attack.t1564.002
logsource:
    category: process_creation
    product: macos
detection:
    dscl_create:
        Image|endswith: '/dscl'
        CommandLine|contains: 'create'
    id_below_500:
        CommandLine|contains: UniqueID
        CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'
    ishidden_option_declaration:
        CommandLine|contains: 'IsHidden'
    ishidden_option_confirmation:
        CommandLine|contains:
            - 'true'
            - 'yes'
            - '1'
    condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
falsepositives:
    - Legitimate administration activities
level: medium

Stages and Predicates

Stage 0: `condition`

dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)

Stage 1: `dscl_create`

dscl_create:
    Image|endswith: '/dscl'
    CommandLine|contains: 'create'

Stage 2: `id_below_500`

id_below_500:
    CommandLine|contains: UniqueID
    CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'

Stage 3: `dscl_create`

dscl_create:
    Image|endswith: '/dscl'
    CommandLine|contains: 'create'

Stage 4: `ishidden_option_declaration`

ishidden_option_declaration:
    CommandLine|contains: 'IsHidden'

Stage 5: `ishidden_option_confirmation`

ishidden_option_confirmation:
    CommandLine|contains:
        - 'true'
        - 'yes'
        - '1'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`1` `IsHidden` `UniqueID` `create` `true` `yes`	`field:"CommandLine" kind:match`
`CommandLine`	regex_match	`([0-9]\|[1-9][0-9]\|[1-4][0-9]{2})`	`field:"CommandLine" kind:regex_match value:"([0-9]\|[1-9][0-9]\|[1-4][0-9]{2})"`
`Image`	ends_with	`/dscl`	`field:"Image" kind:ends_with value:"/dscl"`

Hidden User Creation

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: dscl_create

Stage 2: id_below_500

Stage 3: dscl_create

Stage 4: ishidden_option_declaration

Stage 5: ishidden_option_confirmation

Indicators

Stage 0: `condition`

Stage 1: `dscl_create`

Stage 2: `id_below_500`

Stage 3: `dscl_create`

Stage 4: `ishidden_option_declaration`

Stage 5: `ishidden_option_confirmation`