Evidence: Users
Description: Collect Users
Category: System
Platform: macos
Short Name: users
Is Parsed: Yes
Sent to Investigation Hub: Yes
Collect File(s): No
Background
User account information provides details about local accounts on macOS, including group memberships and account properties. This data is essential for understanding system access and detecting unauthorized accounts.
Data Collected
This collector gathers structured data about users.
Users Data
Field
Description
Example
UserId
User Id
123
Name
Name
Example value
GroupId
Group Id
123
GroupName
Group Name
Example value
Description
Description
Example value
Directory
Directory
Example value
Shell
Shell
Example value
Collection Method
This collector queries osquery’s users joined with groups and records results into the users table.
Forensic Value
This evidence is crucial for forensic investigations as it helps identify suspicious or unauthorized accounts, detect privilege escalation, and audit user management for policy compliance.
