User Added To Admin Group Via DseditGroup on macOS

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•26

Detects attempts to add a user account to the 'admin' group on macOS using the `dseditgroup` utility, which grants administrative privileges to the added user. This action can be used for persistence, privilege escalation, or defense evasion by an attacker.