macOS Local Network Discovery via Network Configuration Commands

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

FreeUnreviewedSigmainformationalv1

macos-local-network-discovery-via-network-configuration-commands-58800443

title: macOS Local Network Discovery via Network Configuration Commands
id: c4e737f2-df51-4f08-8198-6069d28f8ec0
status: test
description: This rule identifies process executions on macOS that enumerate local network configuration by running common networking utilities such as arp, ifconfig, netstat, networksetup, and socketfilterfw. Attackers often perform this discovery to map available interfaces, services, and connectivity before follow-on activity. The detection relies on macOS process creation telemetry by matching executed binary paths and, for one case, reading the firewall preference plist through the defaults utility. It excludes commands launched by the wifivelocityd parent process to reduce noise from legitimate system behavior.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2024-08-29
tags:
  - attack.discovery
  - attack.t1016
logsource:
  product: macos
  category: process_creation
detection:
  selection_1:
    Image|endswith:
      - /arp
      - /ifconfig
      - /netstat
      - /networksetup
      - /socketfilterfw
  selection_2:
    Image: /usr/bin/defaults
    CommandLine|contains|all:
      - /Library/Preferences/com.apple.alf
      - read
  filter_main_wifivelocityd:
    ParentImage|endswith: /wifivelocityd
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
    type: derived

What it detects

This rule identifies process executions on macOS that enumerate local network configuration by running common networking utilities such as arp, ifconfig, netstat, networksetup, and socketfilterfw. Attackers often perform this discovery to map available interfaces, services, and connectivity before follow-on activity. The detection relies on macOS process creation telemetry by matching executed binary paths and, for one case, reading the firewall preference plist through the defaults utility. It excludes commands launched by the wifivelocityd parent process to reduce noise from legitimate system behavior.

Known false positives

Legitimate administration activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.