AN0509: Analytic 0509
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.
Analyst context for executives and security teams
This analytic matters because macOS group membership checks can reveal who has local privileges or access-relevant roles on an endpoint. For security leaders, the practical question is not that commands like dscl, dscacheutil, or id exist; it is whether the organization can distinguish normal administration and troubleshooting from scripted or unusual identity reconnaissance on Macs.
Executive priority
Prioritize this as an identity and endpoint visibility validation item for macOS fleets. It can support incident decision-making by showing whether an actor, script, or administrator is enumerating local group membership before taking further action. The business value is strongest where Mac endpoints are used by privileged staff, developers, executives, or regulated business functions, and where audit evidence depends on proving endpoint activity can be reviewed.
Technical view
Validate whether macOS endpoint telemetry captures execution of dscl, dscacheutil, and id, including command-line arguments, parent process, user context, timestamp, host, and whether execution came from an interactive terminal or automation. Because ATT&CK provides no official detection logic and no tactic mapping for this analytic, SOC teams should treat it as a behavioral signal that requires local baselining rather than a standalone high-confidence alert.
Likely telemetry
- macOS process creation events
- Command-line arguments for dscl, dscacheutil, and id
- Parent process lineage, such as terminal or automation/script runners
- Executing user and effective user context
- Host identity and asset ownership
Detection direction
- Baseline expected administrative, help desk, developer, and management-tool usage of dscl, dscacheutil, and id.
- Look for unusual frequency, broad host coverage, non-interactive/scripted execution, or execution by users and processes that do not normally perform group membership checks.
- Correlate with surrounding endpoint activity rather than treating a single group lookup as inherently malicious.
- Tune for known software management, login, identity, and troubleshooting workflows to reduce false positives.
- Confirm that command-line capture is enabled; process name alone may not show whether group membership was queried.
Mitigation priorities
- Ensure macOS endpoint logging and EDR coverage capture process execution with command-line detail.
- Restrict and monitor privileged local groups and regularly review membership on managed Macs.
- Use least privilege for administrative accounts and automation that may query identity or group data.
- Document approved administrative tooling and expected scripts so detection teams can distinguish normal operations from anomalous enumeration.
- Include this behavior in macOS incident response playbooks as a context signal for identity reconnaissance or privilege assessment.
Analyst notes and limits
The supplied ATT&CK object is a detection analytic for macOS group membership checks using dscl, dscacheutil, or id. There are no supplied relationships, tactics, labels, aliases, or official detection logic, so the strongest use is as a coverage and tuning prompt for macOS process and command-line telemetry.
This take is limited to the supplied STIX fields and external reference. It does not establish malicious intent, active exploitation, adversary attribution, impact, or guaranteed detection. Local baselines, endpoint logging configuration, and administrative workflows are required to determine alert value.
Analytic 0509
Group membership checks via 'dscl', 'dscacheutil', or 'id', typically executed via terminal or automation scripts.
How security teams should use this page
Treat this object as behavior context, not an attribution claim. Validate the related groups, software, data sources, and mitigations against official ATT&CK relationships and your own telemetry before making control-coverage decisions.
All related ATT&CK context
No relationships are available in the current normalized data for this object.
Object version and sync metadata
The fields below describe the current mirrored snapshot. When Glexia retains multiple ATT&CK source imports, you can open the table to compare the same object across releases (hashes and MITRE timestamps). For MITRE’s own release notes and roadmap, see ATT&CK resources — Updates .
Imported snapshots across ATT&CK releases (1)
| Release | Bundle imported | Object version | Modified | Status | Raw hash |
|---|---|---|---|---|---|
| 19.1 | 1.0 | Current bundle | dae2017429e3… |
Mirrored ATT&CK source object
The raw object is retained through the mirrored ATT&CK source bundle and object hash. The raw endpoint returns the exact object from the mirrored bundle when available.
External references and citations
MITRE external references are preserved separately from Glexia analysis so citations remain traceable to their original source records.
-
[1]
mitre-attack AN0509Open source URL
Source: MITRE ATT&CK®. © 2026 The MITRE Corporation. This work is reproduced and distributed with the permission of The MITRE Corporation. MITRE ATT&CK and ATT&CK are registered trademarks of The MITRE Corporation. Glexia is not affiliated with or endorsed by MITRE.