Hidden User Creation

Title: Hidden User Creation
Status: test
Description:Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.002/T1564.002.md
Author: Daniil Yugoslavskiy, oscd.community
Date: 2020-10-10
modified:2021-11-27
Tags:

• -'attack.stealth'
• -'attack.t1564.002'

Logsource:

• category: process_creation
• product: macos

Detection:
  dscl_create:
    Image|endswith: '/dscl'
    CommandLine|contains: 'create'
  id_below_500:
    CommandLine|contains: 'UniqueID'
    CommandLine|re: '([0-9]|[1-9][0-9]|[1-4][0-9]{2})'
  ishidden_option_declaration:
    CommandLine|contains: 'IsHidden'
  ishidden_option_confirmation:
    CommandLine|contains:
      -'true'
      -'yes'
      -'1'

  condition:dscl_create and id_below_500 or dscl_create and (ishidden_option_declaration and ishidden_option_confirmation)
Falsepositives:
  -Legitimate administration activities
Level: medium