Detection of Credential Dumping via macOS Built-In Utilities

Adversaries targeting macOS environments often attempt to escalate privileges or move laterally by extracting user account hashes. This activity leverages built-in system utilities that possess the necessary permissions to access sensitive authentication artifacts. Specifically, tools such as defaults, mkpassdb, and dscl are utilized to query the ShadowHashData attribute, or common file-processing binaries like cat, strings, or plutil are used to read user-specific configuration files located in /var/db/dslocal/nodes/Default/users/. Once these hashes are retrieved, attackers can perform offline brute-force attacks to recover cleartext passwords. Given that these utilities are standard components of the macOS operating system, defenders must monitor for anomalous execution patterns, particularly when these tools are used to access files containing sensitive authentication material. This detection approach is essential for identifying credential access early in the attack lifecycle.

Impact

Successful extraction of local user hashes on macOS allows attackers to perform offline password cracking, potentially compromising user accounts. In enterprise environments, if these accounts share credentials with other systems or services, the breach can lead to unauthorized access to sensitive data, privilege escalation, and lateral movement across the internal network.

Recommendation

• Deploy the provided detection rules to your EDR or SIEM solution to identify unauthorized access to ShadowHashData and user plist files.
• Review and baseline administrative scripts and maintenance tools that legitimately access these system files to reduce false positive alerts.
• Enforce strong, unique password policies and implement multi-factor authentication to mitigate the impact of cracked user hashes.
• Isolate systems showing evidence of unauthorized hash dumping and initiate an incident response process to audit account access and check for lateral movement.