sysadminctl

sysadminctl can be used to enable the guest account

sudo sysadminctl -guestAccount on

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Initial Access

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can be used to create a local user account

sudo sysadminctl -addUser randomUser -password "randomPassword"

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Persistence

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can be used to create a local admin account

sudo sysadminctl -addUser randomUser -password "randomPassword" -admin

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Persistence

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can be used to reset password for a particular user account

sudo sysadminctl -resetPasswordFor randomUser -newPassword "randomPassword"

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Persistence

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can delete the specified user account

sudo sysadminctl -deleteUser randomUser

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Impact

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can enable SMB Guest Access

sudo sysadminctl -smbGuestAccess on

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Exfiltration

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html

sysadminctl can enable AFP Guest Access

sudo sysadminctl -afpGuestAccess on

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Exfiltration

Detection

Sigma: Creation Of A Local User Account: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml

Sigma: User Added To Admin Group Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml

Sigma: Guest Account Enabled Via Sysadminctl: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/sysadminctl.yml

ss64.com/mac/sysadminctl.html