Guest Account Enabled Via Sysadminctl on macOS

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•1•0•32

This rule detects attempts to enable the guest account on macOS systems using the `sysadminctl` utility. Adversaries may enable the guest account to establish persistence, evade defenses, or gain initial access by leveraging a default, often less monitored, account.