MacOS system information discovery via sysctl
Threat actors and malware use the sysctl command on MacOS to retrieve hardware, kernel, and machine-dependent information for environment discovery and virtualization detection.
Triage facts
Revision 1- Applicability
- MacOS
- Evidence
- Unknown
- Severity
- Medium
- Action
- Monitor or close
- Sources
- 6 public sources
- Freshness
- Revision 1Nov 10, 02:40 UTC
- Detection
- 1 rule
- Source quality
- A1Likely
The 'sysctl' utility on MacOS is frequently abused by threat actors to perform system discovery and to detect analysis environments. By querying specific namespaces such as 'hw.', 'kern.', and 'machdep.', malicious code can identify hardware specifications, kernel versions, and whether the process is running within a virtualized sandbox.
Impact
This activity allows attackers to perform reconnaissance on the target machine and to implement evasion tactics, such as terminating execution if a virtualized environment or debugging tool is detected.
Recommendation
Deploy the detection rule below to monitor for suspicious use of the 'sysctl' utility. Focus on process execution telemetry that includes these specific discovery arguments, and baseline administrative usage within your environment to minimize false positives.
Immediate actions
Deploy the provided Sigma rule to your EDR or SIEM to flag sysctl discovery behavior.
Detection coverage 1
Detect MacOS System Information Discovery via Sysctl
mediumDetects the execution of sysctl with arguments commonly used by malware to retrieve hardware, kernel, and machine-dependent information to identify virtualized environments.
Detection queries are available on the platform. Get full rules →