Local System Accounts Discovery - macOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•1•0•26

Detects enumeration of local system accounts on macOS using various command-line utilities such as 'dscl', 'dscacheutil', 'cat /etc/passwd', 'id', and 'lsof -u'. This activity is indicative of an adversary attempting to discover existing user accounts on a compromised system.