macOS dscl User Creation UniqueID

Danny Y@zendannyy

•updated Jun 8, 2026•2•0•11

Detects the creation of local user accounts on macOS using the 'dscl' command-line utility, specifically looking for the '-create' action within the '/Users/' directory and the presence of 'UniqueID' or 'IsHidden' parameters. The rule excludes common system-related UniqueIDs (0, 1, 202, 205, 248) to reduce false positives from legit system operations.