# T1564.002 - Hidden Users
## [Description from ATT&CK](https://attack.mitre.org/techniques/T1564/002)
<blockquote>Adversaries may use hidden users to mask the presence of user accounts they create. Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account.

There is a property value in <code>/Library/Preferences/com.apple.loginwindow</code> called <code>Hide500Users</code> that prevents users with userIDs 500 and lower from appearing at the login screen. When using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 (ex: <code>sudo dscl . -create /Users/username UniqueID 401</code>) and enabling this property (setting it to Yes), an adversary can conceal user accounts. (Citation: Cybereason OSX Pirrit).</blockquote>

## Atomic Tests

- [Atomic Test #1 - Create Hidden User using UniqueID < 500](#atomic-test-1---create-hidden-user-using-uniqueid--500)

- [Atomic Test #2 - Create Hidden User using IsHidden option](#atomic-test-2---create-hidden-user-using-ishidden-option)


<br/>

## Atomic Test #1 - Create Hidden User using UniqueID < 500
Add a hidden user on macOS using Unique ID < 500 (users with that ID are hidden by default)

**Supported Platforms:** macOS


**auto_generated_guid:** 4238a7f0-a980-4fff-98a2-dfc0a363d507





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | username to add | String | APT|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo dscl . -create /Users/#{user_name} UniqueID 333
```

#### Cleanup Commands:
```sh
sudo dscl . -delete /Users/#{user_name}
```





<br/>
<br/>

## Atomic Test #2 - Create Hidden User using IsHidden option
Add a hidden user on macOS using IsHidden optoin

**Supported Platforms:** macOS


**auto_generated_guid:** de87ed7b-52c3-43fd-9554-730f695e7f31





#### Inputs:
| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| user_name | username to add | String | APT|


#### Attack Commands: Run with `sh`!  Elevation Required (e.g. root or admin) 


```sh
sudo dscl . -create /Users/#{user_name} IsHidden 1
```

#### Cleanup Commands:
```sh
sudo dscl . -delete /Users/#{user_name}
```





<br/>
