macOS dscl Account Enumeration via Untrusted/Downloaded Shell Script
This rule detects account and credential enumeration activities using the macOS 'dscl' (Directory Service Command Line) utility. It specifically monitors for 'dscl' commands ('-list /Users', '-read', or '-authonly') being invoked by unsigned shell scripts (sh, bash, zsh) or scripts running from suspicious locations like '/tmp/', '/private/tmp/', '/private/var/folders/', or '/Downloads/'. The rule effectively identifies potential reconnaissance or credential harvesting attempts often associated with malicious macOS 'clickfix' campaigns.
Cortex XDR
