Creation Of A Local User Account

Title: Creation Of A Local User Account
Status: test
Description:Detects the creation of a new user account. Such accounts may be used for persistence that do not require persistent remote access tools to be deployed on the system.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1136.001/T1136.001.md
  -https://ss64.com/osx/sysadminctl.html
Author: Alejandro Ortuno, oscd.community
Date: 2020-10-06
modified:2023-02-18
Tags:

• -'attack.t1136.001'
• -'attack.persistence'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_dscl:
    Image|endswith: '/dscl'
    CommandLine|contains: 'create'
  selection_sysadminctl:
    Image|endswith: '/sysadminctl'
    CommandLine|contains: 'addUser'
  condition:1 of selection_*
Falsepositives:
  -Legitimate administration activities
Level: low