Elastic medium stable eql

Potential Hidden Local User Account Creation

Identifies attempts to create a local account that will be hidden from the macOS logon window. This may indicate an attempt to evade user attention while maintaining persistence using a separate local account.

View Source

Detection Logic

process where host.os.type == "macos" and event.type in ("start", "process_started") and
 process.name == "dscl" and process.args like~ "IsHidden" and process.args like~ "create" and 
 process.args like~ ("true", "1", "yes")

Field Validations

Loading…

Comments (0)

Loading comments...