Local Groups Discovery on macOS

SigmaHQ Detections@sigmaHQ

•updated Aug 12, 2024•2•0•29

Detects enumeration of local system groups on macOS using common command-line utilities such as `dscacheutil`, `cat`, and `dscl`. This activity is often performed by adversaries during the discovery phase to identify privileged accounts or groups for lateral movement or privilege escalation.