System Information Discovery Using System_Profiler
A Sigma rule for process creation on macOS, by Stephen Lincoln `@slincoln_aiq` (AttackIQ).
medium 2 ATT&CK techniques 1 program it names 2 everyday examples trip it
What it looks for
detection:
selection_cmd:
CommandLine|contains:
- 'SPApplicationsDataType'
- 'SPHardwareDataType'
- 'SPNetworkDataType'
- 'SPUSBDataType'
selection_img:
- Image|endswith: '/system_profiler'
- CommandLine|contains: 'system_profiler'
condition: all of selection_*
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Stephen Lincoln `@slincoln_aiq` (AttackIQ), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.
Command lines that trip it
Display a hardware overview (Model, CPU, Memory, Serial, etc.) and software data (System, Kernel, Name, Uptime, etc.) on the page for system_profiler
system_profiler SPHardwareDataType SPSoftwareDataTypeIdentifyPrint the system serial number on the page for system_profiler
system_profiler SPHardwareDataType|grep "Serial Number (system)" | awk '{ print $4 }'Identify