Legitimate user or hacker -Terminal? I have recently used the terminal and entered the command sudo -s and then dscl . -list /users  so I could see all accounts/users who have access to my mac. 

How do I know which names are supposed to be there and which aren't? Luckily I read on another post that nobody and daemon appeared in their list so that calms me down slightly, but does anyone have a link to a list of which accounts are suppose to be there? 

Right now, there are over 25 names, a lot look like file locations but I am freaked out!
All users account starting with an _ are automatically generated by the system. For example, _lp is an account used to manage the Printing Services without the use of the priviledged account root.
This is a separation of priviledges and a good protection.

For all other account names,
daemon and nobody are also generated by the system.

For the remaining accounts, let's say you see a suspect user account bond, use the following command:

finger bond


to check what bond account is used for and when it was last used to connect on your system.