User Added To Admin Group Via Dscl (b743623c-2776-40e0-87b1-682b975d0ca5)

Detects attempts to create and add an account to the admin group via "dscl"

Cluster A	Galaxy A	Cluster B	Galaxy B	Level
Local Accounts - T1078.003 (fdc47f44-dd32-4b99-af5f-209f556f63c2)	Attack Pattern	User Added To Admin Group Via Dscl (b743623c-2776-40e0-87b1-682b975d0ca5)	Sigma-Rules	1
Local Accounts - T1078.003 (fdc47f44-dd32-4b99-af5f-209f556f63c2)	Attack Pattern	Valid Accounts - T1078 (b17a1a56-e99c-403c-8948-561df0cffe81)	Attack Pattern	2