macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Finds macOS network discovery activity by spotting arp/ifconfig/netstat/networksetup/socketfilterfw and specific firewall preference reads.

FreeReviewedSigma · Informational · v2

Product: macos
Category: process_creation
Author: remotephone, oscd.community (SigmaHQ), DRL 1.1
Published: 2020-10-06
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1016System Network Configuration Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions on macOS that enumerate local network configuration by running common network tools (arp, ifconfig, netstat, networksetup, socketfilterfw). It also flags use of the defaults command to read application preferences related to the Apple Firewall configuration. Attackers often perform this type of discovery to map network settings and connectivity before further activity, so matching these command patterns can highlight reconnaissance. The detection relies on process creation telemetry with executable paths and command-line content for the defaults invocation, plus parent process context to suppress wifivelocityd-related activity.

Reporting behind it

Related detections9 linkedT1016 — drag to rearrange

Suspicious Codepage Change Followed By Nltest Domain Trust Discovery

Suspicious Domain Trust Discovery Via Nltest

Malicious Winlogon Process Contact to C2 - Blacklotus - Sysmon (via process_creation)

Suspicious Scheduled Task Enumerated (via process_creation)

Suspicious Firewall Configuration Enumerated - PowerShell (via powershell)

Suspicious Active Directory Subnet Enumeration via ADFind Subnets Query (via process_creation)

Suspicious WMIC Execution from Anomalous Parent Process (via process_creation)

Suspicious External IP Discovery via curl to ifconfig.me via process_creation

Suspicious Wi-Fi Credential Harvesting via netsh wlan show profile (via process_creation)

macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults

Pivot detection · T1016 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-local-network-discovery-via-network-configuration-commands-58800443

title: macOS Local Network Configuration Discovery via ARP/ifconfig/netstat/networksetup/defaults
id: c4e737f2-df51-4f08-8198-6069d28f8ec0
status: test
description: This rule identifies process executions on macOS that enumerate local network configuration by running common network tools (arp, ifconfig, netstat, networksetup, socketfilterfw). It also flags use of the defaults command to read application preferences related to the Apple Firewall configuration. Attackers often perform this type of discovery to map network settings and connectivity before further activity, so matching these command patterns can highlight reconnaissance. The detection relies on process creation telemetry with executable paths and command-line content for the defaults invocation, plus parent process context to suppress wifivelocityd-related activity.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1016/T1016.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_susp_system_network_discovery.yml
author: remotephone, oscd.community, Huntrule Team
date: 2020-10-06
modified: 2024-08-29
tags:
  - attack.discovery
  - attack.t1016
logsource:
  product: macos
  category: process_creation
detection:
  selection_1:
    Image|endswith:
      - /arp
      - /ifconfig
      - /netstat
      - /networksetup
      - /socketfilterfw
  selection_2:
    Image: /usr/bin/defaults
    CommandLine|contains|all:
      - /Library/Preferences/com.apple.alf
      - read
  filter_main_wifivelocityd:
    ParentImage|endswith: /wifivelocityd
  condition: 1 of selection_* and not 1 of filter_main_*
falsepositives:
  - Legitimate administration activities
level: informational
license: DRL-1.1
related:
  - id: 58800443-f9fc-4d55-ae0c-98a3966dfb97
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL