Detectionmediumtest

Hidden User Creation

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Daniil Yugoslavskiy, oscd.communityCreated Sat Oct 10Updated Sat Nov 27b22a5b36-2431-493a-8be1-0bae56c28ef3macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    dscl_create:
        Image|endswith: '/dscl'
        CommandLine|contains: 'create'
    id_below_500:
        CommandLine|contains: UniqueID
        CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'
    ishidden_option_declaration:
        CommandLine|contains: 'IsHidden'
    ishidden_option_confirmation:
        CommandLine|contains:
            - 'true'
            - 'yes'
            - '1'
    condition: dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)