User Added To Admin Group Via Dscl

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•2•0•32

This rule detects attempts to add a user to the 'admin' group on macOS systems using the `dscl` command-line utility. Specifically, it looks for `dscl` commands that include the `-append` option, target the `/Groups/admin` path, and modify `GroupMembership`. This activity is often associated with privilege escalation or persistence by granting administrative rights to a standard user account.