# sysadminctl

> Create/delete local accounts, guest account, enable SMB/AFP Guest access.

sysadminctl can administer system user accounts. sysadminctl can be used to change user passwords, create new 
users (including automatically provisioning the user home folder) or to check the status of a user's SecureToken.

- Page: https://loobins.io/binaries/sysadminctl/
- Author: Hare Sudhan (@cyb3rbuff)
- Created: 2024-11-19
- Tactics: Initial Access, Persistence, Exfiltration, Impact

## Paths

- `/usr/sbin/sysadminctl`

## Example Use Cases

### Enable Guest Account

sysadminctl can be used to enable the guest account

```bash
sudo sysadminctl -guestAccount on
```

- Tactics: Initial Access
- ATT&CK techniques: T1078.001

### Create Local User Account

sysadminctl can be used to create a local user account

```bash
sudo sysadminctl -addUser randomUser -password "randomPassword"
```

- Tactics: Persistence
- ATT&CK techniques: T1136.001
- Tags: users

### Create a Local Admin Account

sysadminctl can be used to create a local admin account

```bash
sudo sysadminctl -addUser randomUser -password "randomPassword" -admin
```

- Tactics: Persistence
- ATT&CK techniques: T1136.001
- Tags: users

### Reset user password

sysadminctl can be used to reset password for a particular user account

```bash
sudo sysadminctl -resetPasswordFor randomUser -newPassword "randomPassword"
```

- Tactics: Persistence
- ATT&CK techniques: T1098
- Tags: password, users

### Delete a local account

sysadminctl can delete the specified user account

```bash
sudo sysadminctl -deleteUser randomUser
```

- Tactics: Impact
- ATT&CK techniques: T1531
- Tags: users

### Enable SMB Guest Access

sysadminctl can enable SMB Guest Access

```bash
sudo sysadminctl -smbGuestAccess on
```

- Tactics: Exfiltration

### Enable AFP Guest Access

sysadminctl can enable AFP Guest Access

```bash
sudo sysadminctl -afpGuestAccess on
```

- Tactics: Exfiltration

## Detections

- [Sigma: Creation Of A Local User Account](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_create_account.yml)
- [Sigma: User Added To Admin Group Via Sysadminctl](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_add_user_to_admin_group.yml)
- [Sigma: Guest Account Enabled Via Sysadminctl](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysadminctl_enable_guest_account.yml)

## Resources

- [sysadminctl man page](https://ss64.com/mac/sysadminctl.html)