CmdID

CmdID / Rules / macOS

System Information Discovery Using sw_vers

A Sigma rule for process creation on macOS, by Joseliyo Sanchez, @Joseliyo_Jstnk.

medium 1 ATT&CK technique 1 program it names 2 everyday examples trip it

What it looks for

its detection, as SigmaHQ writes it
detection:
  selection_image:
    Image|endswith: '/sw_vers'
  selection_options:
    CommandLine|contains:
      - '-buildVersion'
      - '-productName'
      - '-productVersion'
  condition: all of selection_*

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Joseliyo Sanchez, @Joseliyo_Jstnk, under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.

Command lines that trip it

everyday examples from tldr-pages, CC BY 4.0, each read by CmdID

Print only the version number of the operating system on the page for sw_vers

sw_vers -productVersionIdentify

Print only the build identifier on the page for sw_vers

sw_vers -buildVersionIdentify

Programs and files it names

their pages here
sw_vers

ATT&CK

the techniques it is tagged with
T1082System Information Discovery

Other rules for T1082 System Information Discovery

OS Architecture Discovery Via Grep · Potential GobRAT File Discovery Via Grep · Container Residence Discovery Via Proc Virtual FS · Docker Container Discovery Via Dockerenv Listing · Potential Container Discovery Via Inodes Listing · System Information Discovery · System Information Discovery Using Ioreg · System Information Discovery Via Sysctl - MacOS · System Information Discovery Using System_Profiler · CMD Shell Output Redirect · System Information Discovery via Registry Queries · Suspicious Kernel Dump Using Dtrace