macOS Root Account Enablement via dsenableroot

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•30

Detects attempts to enable the root account on macOS systems using the 'dsenableroot' command-line utility. This action can be used for persistence, privilege escalation, or defense evasion by adversaries.