Detection of macOS Firewall Configuration Enumeration

Adversaries targeting macOS endpoints often engage in network and security configuration discovery to understand the local defensive posture. This threat involves the use of native utilities, specifically the defaults command to read the com.apple.alf preference domain and the socketfilterfw (Application Firewall) binary to query the global firewall state. While these tools are essential for system administration and troubleshooting, their execution by non-privileged users or outside of established maintenance windows can serve as an indicator of attacker reconnaissance. By querying these interfaces, an adversary can determine if the application firewall is active, identify blocked or allowed applications, and map out existing network access policies, which helps them tailor subsequent lateral movement or C2 traffic to evade detection.

Impact

Successful enumeration of firewall rules allows attackers to identify gaps in the security posture of macOS systems. This intelligence facilitates the selection of stealthier persistence and C2 techniques that are less likely to be blocked by existing local firewall policies, increasing the risk of successful long-term system compromise in corporate environments.

Recommendation

Deploy detection rules to monitor for the execution of firewall-related reconnaissance commands.

• Implement process creation logging via EndpointSecurity framework or osquery to capture command-line arguments for defaults and socketfilterfw.
• Deploy the provided Sigma rule to your SIEM to monitor for unauthorized execution of these utilities.
• Baseline administrative activity by identifying and excluding known service accounts, MDM agents, or IT support tools that legitimately query firewall settings.