macOS File and Directory Discovery via System Utilities
Detects macOS usage of file, ls -R, find, mdfind, or tree for file/directory enumeration.
- Product
- macos
- Category
- process_creation
- Author
- Daniil Yugoslavskiy, oscd.community (SigmaHQ), DRL 1.1
- Published
- 2020-10-19
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process executions of common discovery utilities used to enumerate files and directories, including /usr/bin/file with long command lines, recursive listing with /bin/ls -R, and filesystem search tools such as /usr/bin/find and /usr/bin/mdfind. Attackers often use these commands to map targets before staging additional activity. It relies on process creation telemetry capturing the executed Image path and CommandLine content patterns (regular expression, substring, and suffix matches).
Reporting behind it
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS File and Directory Discovery via System Utilities
id: 3fb7bd61-eac7-4bce-a5f4-3c38fae1027d
status: test
description: This rule flags macOS process executions of common discovery utilities used to enumerate files and directories, including /usr/bin/file with long command lines, recursive listing with /bin/ls -R, and filesystem search tools such as /usr/bin/find and /usr/bin/mdfind. Attackers often use these commands to map targets before staging additional activity. It relies on process creation telemetry capturing the executed Image path and CommandLine content patterns (regular expression, substring, and suffix matches).
references:
- https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1083/T1083.md
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_file_and_directory_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-11-25
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: macos
detection:
select_file_with_asterisk:
Image: /usr/bin/file
CommandLine|re: (.){200,}
select_recursive_ls:
Image: /bin/ls
CommandLine|contains: -R
select_find_execution:
Image: /usr/bin/find
select_mdfind_execution:
Image: /usr/bin/mdfind
select_tree_execution|endswith:
Image: /tree
condition: 1 of select*
falsepositives:
- Legitimate activities
level: informational
license: DRL-1.1
related:
- id: 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
type: derived