macOS Process Execution of system_profiler for System Discovery via Specific Data Types
Flags macOS system_profiler runs that request application, hardware, network, and USB data via command-line data types.
- Product
- macos
- Category
- process_creation
- Author
- Stephen Lincoln `@slincoln_aiq` (AttackIQ) (SigmaHQ), DRL 1.1
- Published
- 2024-01-02
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies macOS process execution where system_profiler is launched and its command line includes specific data types tied to system discovery. Attackers commonly use system information collection to understand the environment before staging or tailoring follow-on activity, including potential checks relevant to virtualization. Detection relies on process creation telemetry capturing the executed image path and command line contents.
Reporting behind it
- trendmicro.comhttps://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
- sentinelone.comhttps://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
- ss64.comhttps://ss64.com/mac/system_profiler.html
- objective-see.orghttps://objective-see.org/blog/blog_0x62.html
- welivesecurity.comhttps://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
- gist.github.comhttps://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Process Execution of system_profiler for System Discovery via Specific Data Types
id: 4beac4d1-fd70-4421-9a89-9d61752d9fcd
status: test
description: This rule identifies macOS process execution where system_profiler is launched and its command line includes specific data types tied to system discovery. Attackers commonly use system information collection to understand the environment before staging or tailoring follow-on activity, including potential checks relevant to virtualization. Detection relies on process creation telemetry capturing the executed image path and command line contents.
references:
- https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
- https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
- https://ss64.com/mac/system_profiler.html
- https://objective-see.org/blog/blog_0x62.html
- https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
- https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml
author: Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule Team
date: 2024-01-02
tags:
- attack.discovery
- attack.stealth
- attack.t1082
- attack.t1497.001
logsource:
product: macos
category: process_creation
detection:
selection_img:
- Image|endswith: /system_profiler
- CommandLine|contains: system_profiler
selection_cmd:
CommandLine|contains:
- SPApplicationsDataType
- SPHardwareDataType
- SPNetworkDataType
- SPUSBDataType
condition: all of selection_*
falsepositives:
- Legitimate administrative activities
level: medium
license: DRL-1.1
related:
- id: 4809c683-059b-4935-879d-36835986f8cf
type: derived