systemsetup

systemsetup configures certain per-machine settings typically configured in the System Preferences application. The systemsetup command requires at least "admin" privileges to run.

Author: Hare Sudhan (@cyb3rbuff) Created: 2023-08-31

Lateral Movement ssh configuration

Paths

/usr/sbin/systemsetup

Example Use Cases

Enable Remote Login

systemsetup can be used to enable SSH for remote login

sudo systemsetup -setremotelogin on

Lateral Movement ssh configuration

Enable Remote Apple Events

systemsetup can be used to enable Remote Apple Events. Set whether the system responds to events sent by other computers (such as AppleScripts).

sudo systemsetup -setremoteappleevents on

Lateral Movement configuration

Detections

Command line argument detection containing (args contain systemsetup AND (-setremoteappleevents OR -setremotelogin) AND on)
Jamf Protect: Detect systemsetup activity that enables remotelogin or appleremoteevents

Resources

systemsetup man page