macOS Process Discovery via system_profiler with Targeted Data Types

title: macOS Process Discovery via system_profiler with Targeted Data Types
id: 4beac4d1-fd70-4421-9a89-9d61752d9fcd
status: test
description: This rule matches executions of the macOS system_profiler command where the command line includes specific system_profiler data types related to applications, hardware, network, and USB. Attackers commonly use this type of system information discovery to enumerate the environment and identify defensive or virtualized characteristics. Detection relies on process creation telemetry that includes the process image path and full command line contents.
references:
  - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
  - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
  - https://ss64.com/mac/system_profiler.html
  - https://objective-see.org/blog/blog_0x62.html
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml
author: Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule Team
date: 2024-01-02
tags:
  - attack.discovery
  - attack.stealth
  - attack.t1082
  - attack.t1497.001
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    - Image|endswith: /system_profiler
    - CommandLine|contains: system_profiler
  selection_cmd:
    CommandLine|contains:
      - SPApplicationsDataType
      - SPHardwareDataType
      - SPNetworkDataType
      - SPUSBDataType
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 4809c683-059b-4935-879d-36835986f8cf
    type: derived