macOS Process Execution of system_profiler for System Discovery via Specific Data Types

ATT&CK techniques

Defense Evasion → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1497.001System Checks
Cred Access
Discovery
- T1082System Information Discovery
- T1497.001System Checks
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies macOS process execution where system_profiler is launched and its command line includes specific data types tied to system discovery. Attackers commonly use system information collection to understand the environment before staging or tailoring follow-on activity, including potential checks relevant to virtualization. Detection relies on process creation telemetry capturing the executed image path and command line contents.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

macOS Process Execution of system_profiler for System Discovery via Specific Data Types

Pivot detection · T1082 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-discovery-via-system-profiler-with-targeted-data-types-4809c683

title: macOS Process Execution of system_profiler for System Discovery via Specific Data Types
id: 4beac4d1-fd70-4421-9a89-9d61752d9fcd
status: test
description: This rule identifies macOS process execution where system_profiler is launched and its command line includes specific data types tied to system discovery. Attackers commonly use system information collection to understand the environment before staging or tailoring follow-on activity, including potential checks relevant to virtualization. Detection relies on process creation telemetry capturing the executed image path and command line contents.
references:
  - https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
  - https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
  - https://ss64.com/mac/system_profiler.html
  - https://objective-see.org/blog/blog_0x62.html
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml
author: Stephen Lincoln `@slincoln_aiq` (AttackIQ), Huntrule Team
date: 2024-01-02
tags:
  - attack.discovery
  - attack.stealth
  - attack.t1082
  - attack.t1497.001
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    - Image|endswith: /system_profiler
    - CommandLine|contains: system_profiler
  selection_cmd:
    CommandLine|contains:
      - SPApplicationsDataType
      - SPHardwareDataType
      - SPNetworkDataType
      - SPUSBDataType
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 4809c683-059b-4935-879d-36835986f8cf
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL