Creation Of A Local User Account On macOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•3•0•20

Detects the creation of a new local user account on macOS systems using either the 'dscl' or 'sysadminctl' commands. Such accounts may be used for persistence without requiring persistent remote access tools.