Hidden User Creation on macOS
Detects the creation of hidden user accounts on macOS. This can occur either by assigning a UserID less than 500 or by explicitly setting the 'IsHidden' option to true during account creation using the 'dscl' command-line utility.
Sigma
