Users

Overview

Evidence: Users Description: Collect Users Category: System Platform: macos Short Name: users Is Parsed: Yes Sent to Investigation Hub: Yes Collect File(s): No

Background

User account information provides details about local accounts on macOS, including group memberships and account properties. This data is essential for understanding system access and detecting unauthorized accounts.

Data Collected

This collector gathers structured data about users.

Users Data

Field	Description	Example
UserId	User Id	123
Name	Name	Example value
GroupId	Group Id	123
GroupName	Group Name	Example value
Description	Description	Example value
Directory	Directory	Example value
Shell	Shell	Example value

Collection Method

This collector queries osquery’s users joined with groups and records results into the users table.

Forensic Value

This evidence is crucial for forensic investigations as it helps identify suspicious or unauthorized accounts, detect privilege escalation, and audit user management for policy compliance.