Enable remote login, remote apple events for the machine
systemsetupsystemsetupSandbox: execFile · Timeout: 30s
network.lateralmovement Enable Remote Login: systemsetup can be used to enable SSH for remote login
sudo systemsetup -setremotelogin on
Enable Remote Apple Events: systemsetup can be used to enable Remote Apple Events. Set whether the system responds to events sent by other computers (such as AppleScripts).
sudo systemsetup -setremoteappleevents on
| Type | Rule / Indicator |
|---|---|
| other | https://www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on) |
| other | https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents |
systemsetup configures certain per-machine settings typically configured in the System Preferences application. The systemsetup command requires at least "admin" privileges to run.