Updates to Enumeration of Groups on MacOS

Summary

The MacOS user & group enumeration plugin has been updated to enumerate nested groups, and to collect the SMBSID for Active-Directory-created groups.

Change

Users and groups on a MacOS scan target are enumerated with plugin 95929. The plugin has been improved, and will now enumerate nested groups - groups that are a subset of another group. In addition, if a group was created by Microsoft Active Directory or Entra, by joining the scan target to one of these directory services, the SMBSID of the group will be collected, so that it can be used as a unique identifier to match with other assets.

Impact

Additional nested group and SMBSID group data will be added to the existing users and groups identified in Plugin 95929, if available. Users should see no expansion of users or groups identified in their scan output as a result of this change.

Plugin

95929 - macOS and Mac OS X User List Enumeration

Target Release Date

August 23. 2023