Create/delete local accounts, guest account, enable SMB/AFP Guest access.
sysadminctlsysadminctlSandbox: execFile · Timeout: 30s
security.execution.command security.persistence.hook impact.destruction exfiltration.data Enable Guest Account: sysadminctl can be used to enable the guest account
sudo sysadminctl -guestAccount on
Create Local User Account: sysadminctl can be used to create a local user account
sudo sysadminctl -addUser randomUser -password "randomPassword"
Create a Local Admin Account: sysadminctl can be used to create a local admin account
sudo sysadminctl -addUser randomUser -password "randomPassword" -admin
Reset user password: sysadminctl can be used to reset password for a particular user account
sudo sysadminctl -resetPasswordFor randomUser -newPassword "randomPassword"
Delete a local account: sysadminctl can delete the specified user account
sudo sysadminctl -deleteUser randomUser
Enable SMB Guest Access: sysadminctl can enable SMB Guest Access
sudo sysadminctl -smbGuestAccess on
Enable AFP Guest Access: sysadminctl can enable AFP Guest Access
sudo sysadminctl -afpGuestAccess on
| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml Sigma: Creation Of A Local User Account |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml Sigma: User Added To Admin Group Via Sysadminctl |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml Sigma: Guest Account Enabled Via Sysadminctl |
sysadminctl can administer system user accounts. sysadminctl can be used to change user passwords, create new users (including automatically provisioning the user home folder) or to check the status of a user's SecureToken.