# systemsetup

> Enable remote login, remote apple events for the machine

systemsetup configures certain per-machine settings typically configured in the System Preferences application.
The systemsetup command requires at least "admin" privileges to run.

- Page: https://loobins.io/binaries/systemsetup/
- Author: Hare Sudhan (@cyb3rbuff)
- Created: 2023-08-31
- Tactics: Lateral Movement

## Paths

- `/usr/sbin/systemsetup`

## Example Use Cases

### Enable Remote Login

systemsetup can be used to enable SSH for remote login

```bash
sudo systemsetup -setremotelogin on
```

- Tactics: Lateral Movement
- Tags: ssh, configuration

### Enable Remote Apple Events

systemsetup can be used to enable Remote Apple Events. 
Set whether the system responds to events sent by other computers (such as AppleScripts).

```bash
sudo systemsetup -setremoteappleevents on
```

- Tactics: Lateral Movement
- Tags: configuration

## Detections

- [Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)](https://www.elastic.co/guide/en/security/current/remote-ssh-login-enabled-via-systemsetup-command.html)
- [Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/systemsetup_activity)

## Resources

- [systemsetup man page](https://ss64.com/osx/systemsetup.html)