Local System Accounts Discovery - MacOs

testlow
Log-Quelle: macos · process_creationAutor Alejandro Ortuno, oscd.communityDatum 2020-10-08
01

Beschreibung

Was dies ist, in Kürze.

Detects enumeration of local system accounts on MacOS systems. This can be used by attackers to identify accounts for lateral movement or privilege escalation.

02

Tags

attack.discoveryattack.t1087.001
03

Regelquelle (YAML)

title: Local System Accounts Discovery - MacOs
id: ddf36b67-e872-4507-ab2e-46bda21b842c
status: test
description: |
    Detects enumeration of local system accounts on MacOS systems.
    This can be used by attackers to identify accounts for lateral movement or privilege escalation.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1087.001/T1087.001.md
    - https://ss64.com/osx/dscl.html
    - https://ss64.com/mac/dscacheutil.html
author: Alejandro Ortuno, oscd.community
date: 2020-10-08
modified: 2026-07-07
tags:
    - attack.discovery
    - attack.t1087.001
logsource:
    category: process_creation
    product: macos
detection:
    selection_dscl:
        Image|endswith: '/dscl'
        CommandLine|contains|all:
            - 'list'
            - '/users'
    selection_dscacheutil:
        Image|endswith: '/dscacheutil'
        CommandLine|contains|all:
            - '-q'
            - 'user'
    selection_root:
        CommandLine|contains: '''*:0:'''
    selection_passwd_sudo:
        Image|endswith:
            - '/cat'
            - '/awk'
            - '/grep'
        CommandLine|contains:
            - '/etc/passwd'
            - '/etc/sudoers'
    selection_id:
        Image|endswith: '/id'
    selection_lsof:
        Image|endswith: '/lsof'
        CommandLine|contains: '-u'
    selection_logged_in_users:
        Image|endswith:
            - '/who'
            - '/w'
            - '/users'
            - '/last'
    selection_home_dir_listing:
        Image|endswith: '/ls'
        CommandLine|endswith:
            - '/Users'
            - "/Users'"
            - '/Users"'
    selection_loginwindow_prefs:
        Image|endswith:
            - '/defaults' # defaults read /Library/Preferences/com.apple.loginwindow
            - '/plutil' # plutil -p /Library/Preferences/com.apple.loginwindow.plist
        CommandLine|contains: 'com.apple.loginwindow'
    condition: 1 of selection*
falsepositives:
    - Legitimate administration activities
level: low
04

erkennt Techniken (1)

ATT&CK-Techniken, die dies ermöglicht oder abbildet.

05

Referenzen

Externe Belege — Patches, Meldungen, Analysen.