macOS Hidden User - dscl Sets IsHidden Attribute

Danny Y@zendannyy

•updated Jun 10, 2026•0•0•7

Detects setting IsHidden on a macOS user record to suppress the account from the login screen. Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).