MacOS: System information discovery via system_profiler
Threat actors and malware frequently use the system_profiler utility on MacOS to perform system information discovery and identify virtualization for environment checks.
Triage facts
Revision 1- Applicability
- macOS
- Evidence
- Unknown
- Severity
- Medium
- Action
- Elevated
- Sources
- 3 public sources
- Freshness
- Revision 1Nov 10, 02:40 UTC
- Detection
- 1 rule
- Source quality
- B2Likely
The MacOS command-line utility 'system_profiler' is frequently leveraged by threat actors to perform reconnaissance on host systems. By querying specific data types, attackers can gather detailed hardware and software configuration information, which assists in profiling the victim's environment. Additionally, this utility is used for sandbox detection or identifying virtualization software to support defense evasion.
Recommendation
Detection engineering teams should monitor for the execution of 'system_profiler' with sensitive flags. Because administrative scripts may legitimately utilize these commands, baseline environment activity to reduce false positives before enabling high-alerting thresholds.
- Deploy the provided Sigma rule to identify unauthorized or suspicious calls to 'system_profiler'.
- Audit scripts and management tools that perform system discovery to establish a baseline of authorized behavior.
Immediate actions
Deploy Sigma detection for system_profiler discovery
Threat Hunt
Identify processes running system_profiler with unauthorized arguments
Data: Process creation logs containing CommandLine
Detection coverage 1
Detect System Information Discovery Using System_Profiler
mediumDetects the execution of system_profiler with specific data types often used by malware for system discovery or environment checks.
Detection queries are available on the platform. Get full rules →