systemsetup #

Created by Hare Sudhan (@cyb3rbuff)

Description ##

systemsetup configures certain per-machine settings typically configured in the System Preferences application. The systemsetup command requires at least “admin” privileges to run.

Paths ##

• /usr/sbin/systemsetup

Use Cases ##

Enable Remote Login ##

systemsetup can be used to enable SSH for remote login

sudo systemsetup -setremotelogin on

Enable Remote Apple Events ##

systemsetup can be used to enable Remote Apple Events. Set whether the system responds to events sent by other computers (such as AppleScripts).

sudo systemsetup -setremoteappleevents on

Detections ##

• Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)

• Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents

Resources ##

• systemsetup man page