T1147.md

T1147 - Hidden Users

Description from ATT&CK

Every user account in macOS has a userID associated with it. When creating a user, you can specify the userID for that account. There is a property value in /Library/Preferences/com.apple.loginwindow called Hide500Users that prevents users with userIDs 500 and lower from appearing at the login screen. By using the Create Account technique with a userID under 500 and enabling this property (setting it to Yes), an adversary can hide their user accounts much more easily: sudo dscl . -create /Users/username UniqueID 401 (Citation: Cybereason OSX Pirrit).

Detection: This technique prevents the new user from showing up at the log in screen, but all of the other signs of a new user still exist. The user still gets a home directory and will appear in the authentication logs.

Platforms: macOS

Data Sources: Authentication logs, File monitoring

Permissions Required: Administrator, root

Atomic Tests

• Atomic Test #1 - Hidden Users

Atomic Test #1 - Hidden Users

Add a hidden user on MacOS

Supported Platforms: macOS

Inputs

Name	Description	Type	Default Value
user_name	username to add	string	APT

Run it with sh!

sudo dscl . -create /Users/${user_name} UniqueID 333