Sigma rule: System Information Discovery Using System_Profiler

Rule

Title

System Information Discovery Using System_Profiler

Status

test

Level

medium

Author

Stephen Lincoln `@slincoln_aiq` (AttackIQ)

Date

2024-01-02

File

rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information.
This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

Log source

product

macos

category

process_creation

Detection

selection_img:
    - Image|endswith: '/system_profiler'
    - CommandLine|contains: 'system_profiler'
selection_cmd:
    # Note: This list is based on CTI reporting. Threat actors might use other data types. Please refere to https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af for a full list
    CommandLine|contains:
        - 'SPApplicationsDataType'
        - 'SPHardwareDataType'
        - 'SPNetworkDataType'
        - 'SPUSBDataType'
condition: all of selection_*

False positives (as the rule lists them)

• Legitimate administrative activities

Tags

• attack.discovery
• attack.stealth
• attack.t1082
• attack.t1497.001

MITRE ATT&CK ids this rule names

• T1082
• T1497.001

References

• https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
• https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
• https://ss64.com/mac/system_profiler.html
• https://objective-see.org/blog/blog_0x62.html
• https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
• https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml