CmdID

CmdID / Commands

system_profiler

Report system hardware and software configuration. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Display a report with specific details level (mini [no personal information], basic, or full)

system_profiler -detailLevel levelIdentify

Display a full system profiler report which can be opened by System Profiler.app

system_profiler -xml >MyReport.spxIdentify

Display a hardware overview (Model, CPU, Memory, Serial, etc.) and software data (System, Kernel, Name, Uptime, etc.)

system_profiler SPHardwareDataType SPSoftwareDataTypeIdentify

Trips 1 Sigma rule: mediumSystem Information Discovery Using System_Profiler by Stephen Lincoln `@slincoln_aiq` (AttackIQ)

Print the system serial number

system_profiler SPHardwareDataType|grep "Serial Number (system)" | awk '{ print $4 }'Identify

Trips 1 Sigma rule: mediumSystem Information Discovery Using System_Profiler by Stephen Lincoln `@slincoln_aiq` (AttackIQ)

Display the negotiated max wattage of the connected charger and cable

system_profiler SPPowerDataType | awk '/Wattage/ {print $3}'Identify

What detects it

Sigma process creation rules that name system_profiler
mediumSystem Information Discovery Using System_ProfilerStephen Lincoln `@slincoln_aiq` (AttackIQ)