CircleCI Atomic Red Team doc generator
1.2 KiB
1.2 KiB
T1147 - Hidden Users
Description from ATT&CK
Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in/Library/Preferences/com.apple.loginwindowcalledHide500Usersthat prevents users with userIDs 500 and lower from appearing at the login screen. By using the [Create Account](https://attack.mitre.org/techniques/T1136) technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily:sudo dscl . -create /Users/username UniqueID 401(Citation: Cybereason OSX Pirrit).
Atomic Tests
Atomic Test #1 - Hidden Users
Add a hidden user on MacOS
Supported Platforms: macOS
Inputs
| Name | Description | Type | Default Value |
|---|---|---|---|
| user_name | username to add | string | APT |
Run it with sh!
sudo dscl . -create /Users/#{user_name} UniqueID 333