> ## Documentation Index
> Fetch the complete documentation index at: https://docs.specterops.io/llms.txt
> Use this file to discover all available pages before exploring further.

# add_user

> Add a local user to the system by wrapping the Apple binary, dscl.

## Summary

Add a local user to the system by wrapping the Apple binary, dscl.

* Needs Admin: True
* Version: 1
* Author: @its\_a\_feature\_

<Tip>
  For `Authenticate as this user` and `Authenticate with this password` dropdowns to be available, add credentials under the Operational Views tab in Mythic
</Tip>

### Arguments

#### password

* Description: p\@55w0rd\_here for new user
* Required Value: False
* Default Value: p\@55w0rd\_here

#### passwd

* Description: password of the user that will execute the commands.
* Required Value: True
* Default Value: None

#### user

* Description: username that will execute the commands.
* Required Value: True
* Default Value: None

#### createprofile

* Description: create a user profile or not
* Required Value: False
* Default Value: False

#### usershell

* Description: which shell environment should the new user have
* Required Value: False
* Default Value: /bin/bash

#### primarygroupid

* Description: POSIX primary group id for the new account
* Required Value: False
* Default Value: 80

#### uniqueid

* Description: POSIX unique id for the user
* Required Value: False
* Default Value: 403

#### homedir

* Description: /Users/.jamf\_support
* Required Value: False
* Default Value: None

#### realname

* Description: Full user name
* Required Value: False
* Default Value: Jamf Support User

#### username

* Description: POSIX username for account
* Required Value: False
* Default Value: .jamf\_support

#### hidden

* Description: Should the account be hidden from the logon screen
* Required Value: False
* Default Value: False

#### admin

* Description: Should the account be an admin account
* Required Value: False
* Default Value: True

## Usage

```
add_user
```

## MITRE ATT\&CK Mapping

* T1136
* T1169

## Detailed Summary

This is a very noisy and non-opsec safe command since it does a LOT Of `dscl` commands via `shell_elevated` style of execution such as:

```javascript theme={null}
let cmd = "dscl . create /Users/" + username;
currentApp.doShellScript(cmd, {administratorPrivileges:true, userName:user, password:passwd});
```