Sigma rule: System Information Discovery Using Ioreg

Rule

Title

System Information Discovery Using Ioreg

Status

test

Level

medium

Author

Joseliyo Sanchez, @Joseliyo_Jstnk

Date

2023-12-20

Modified

2024-01-02

File

rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Log source

product

macos

category

process_creation

Detection

# Examples:
#   /bin/bash /bin/sh -c ioreg -l | grep -e 'VirtualBox' -e 'Oracle' -e 'VMware' -e 'Parallels' | wc -l
#   /usr/sbin/ioreg ioreg -rd1 -w0 -c AppleAHCIDiskDriver
#   /bin/bash /bin/sh -c ioreg -l | grep -e 'USB Vendor Name'
#   ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \"\\\"\"); printf(\"%s\", line[4]); }
selection_img:
    - Image|endswith: '/ioreg'
    - CommandLine|contains: 'ioreg'
selection_cmd1:
    CommandLine|contains:
        - '-l'
        - '-c'
selection_cmd2:
    CommandLine|contains:
        - 'AppleAHCIDiskDriver'
        - 'IOPlatformExpertDevice'
        - 'Oracle'
        - 'Parallels'
        - 'USB Vendor Name'
        - 'VirtualBox'
        - 'VMware'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate administrative activities

Tags

• attack.discovery
• attack.t1082

MITRE ATT&CK ids this rule names

• T1082

References

• https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
• https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
• https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
• https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml