macOS Process Discovery via ioreg I/O Kit Registry Queries
Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.
- Product
- macos
- Category
- process_creation
- Author
- Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
- Published
- 2023-12-20
- Updated
- 2026-07-31
ATT&CK techniques
DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule identifies execution of macOS ioreg to collect I/O Kit registry and system-related information. Attackers may use ioreg output to enumerate hardware, virtualized environments, or device details as part of system reconnaissance. It relies on process creation telemetry, matching image paths ending in ioreg and command-line arguments that include common ioreg options and target class/vendor strings.
Reporting behind it
- virustotal.comhttps://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
- virustotal.comhttps://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
- virustotal.comhttps://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
- trendmicro.comhttps://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS Process Discovery via ioreg I/O Kit Registry Queries
id: b6c13c04-e9b9-4a33-a42c-42a5cb184abb
status: test
description: This rule identifies execution of macOS ioreg to collect I/O Kit registry and system-related information. Attackers may use ioreg output to enumerate hardware, virtualized environments, or device details as part of system reconnaissance. It relies on process creation telemetry, matching image paths ending in ioreg and command-line arguments that include common ioreg options and target class/vendor strings.
references:
- https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
- https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
- https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
- https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
modified: 2024-01-02
tags:
- attack.discovery
- attack.t1082
logsource:
product: macos
category: process_creation
detection:
selection_img:
- Image|endswith: /ioreg
- CommandLine|contains: ioreg
selection_cmd1:
CommandLine|contains:
- -l
- -c
selection_cmd2:
CommandLine|contains:
- AppleAHCIDiskDriver
- IOPlatformExpertDevice
- Oracle
- Parallels
- USB Vendor Name
- VirtualBox
- VMware
condition: all of selection_*
falsepositives:
- Legitimate administrative activities
level: medium
license: DRL-1.1
related:
- id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0
type: derived