CatalogLOOBins

ORCHARD · Tool

systemsetup

2 techniquesmacOSLOOBinsGPL-3.0

Enable Remote Login

Lateral MovementmacOS

systemsetup can be used to enable SSH for remote login

sudo systemsetup -setremotelogin on
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Lateral Movement
Detection
Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on): www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html
Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity

Enable Remote Apple Events

Lateral MovementmacOS

systemsetup can be used to enable Remote Apple Events. Set whether the system responds to events sent by other computers (such as AppleScripts). 

sudo systemsetup -setremoteappleevents on
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Lateral Movement
Detection
Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on): www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html
Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity