dscl

Enumerate all local users.

dscl . -list /Users
dscl . list /Users
dscl . ls /Users

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Enumerate all Active Directory users.

dscl "/Active Directory/TEST/All Domains" -list /Users
dscl "/Active Directory/TEST/All Domains" list /Users
dscl "/Active Directory/TEST/All Domains" ls /Users

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Gain useful local user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

dscl . -read /Users/$USERNAME
dscl . read /Users/$USERNAME
dscl . cat /Users/$USERNAME

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Gain useful Active Directory user information such as when their password was last set, their keyboard layout, their avatar, their home directory, UID and default shell.

dscl "/Active Directory/TEST/All Domains" -read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" read /Users/$USERNAME
dscl "/Active Directory/TEST/All Domains" cat /Users/$USERNAME

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Enumerate all local groups.

dscl . -list /Groups
dscl . list /Groups
dscl . ls /Groups

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Enumerate all Active Directory groups.

dscl "/Active Directory/TEST/All Domains" -list /Groups
dscl "/Active Directory/TEST/All Domains" list /Groups
dscl "/Active Directory/TEST/All Domains" ls /Groups

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Gain useful local group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

dscl . -read /Groups/$GROUPNAME
dscl . read /Groups/$GROUPNAME
dscl . cat /Groups/$GROUPNAME

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Gain useful Active Directory group information such as which users belong to that group, SMB SIDs and group ID. Especially useful for the "admin" group.

dscl "/Active Directory/TEST/All Domains" -read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" read /Groups/$GROUPNAME
dscl "/Active Directory/TEST/All Domains" cat /Groups/$GROUPNAME

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Enumerate all computers in an Active Directory.

dscl  "/Active Directory/TEST/All Domains" -list /Computers
dscl  "/Active Directory/TEST/All Domains" list /Computers
dscl  "/Active Directory/TEST/All Domains" ls /Computers

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Enumerate all shares.

dscl . -list /SharePoints
dscl . list /SharePoints
dscl . ls /SharePoints

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Gain password policy information

dscl . -read /Config/shadowhash
dscl . read /Config/shadowhash
dscl . cat /Config/shadowhash

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Change an existing user's password.

dscl . passwd /Users/$USERNAME oldPassword newPassword

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Persistence

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/

Create a local account

dscl -create

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Persistence

Detection

Jamf Protect: Detect user account creation with dscl: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/user_created_by_dscl

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/dscl.yml

book.hacktricks.xyz/macos-hardening/macos-security-and-privilege-escalation/macos-red-teaming

attack.mitre.org/techniques/T1136/001/