macOS Process Monitoring for I/O Kit Registry Discovery via ioreg

Flags macOS executions of ioreg with discovery-oriented arguments and device/vendor strings from command-line telemetry.

FreeUnreviewedSigmamediumv1

macos-process-monitoring-for-i-o-kit-registry-discovery-via-ioreg-2d5e7a8b

title: macOS Process Monitoring for I/O Kit Registry Discovery via ioreg
id: b6c13c04-e9b9-4a33-a42c-42a5cb184abb
status: test
description: This rule identifies macOS processes that invoke the ioreg utility and include ioreg-related command-line arguments. Attackers use ioreg to enumerate system and hardware information, which can support discovery, profiling, and subsequent targeting. Detection relies on process creation telemetry including the executable path and command-line contents such as ioreg usage with flags (e.g., -l, -c) and discovery-relevant device or vendor strings.
references:
  - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior
  - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior
  - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior
  - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
modified: 2024-01-02
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    - Image|endswith: /ioreg
    - CommandLine|contains: ioreg
  selection_cmd1:
    CommandLine|contains:
      - -l
      - -c
  selection_cmd2:
    CommandLine|contains:
      - AppleAHCIDiskDriver
      - IOPlatformExpertDevice
      - Oracle
      - Parallels
      - USB Vendor Name
      - VirtualBox
      - VMware
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0
    type: derived

What it detects

This rule identifies macOS processes that invoke the ioreg utility and include ioreg-related command-line arguments. Attackers use ioreg to enumerate system and hardware information, which can support discovery, profiling, and subsequent targeting. Detection relies on process creation telemetry including the executable path and command-line contents such as ioreg usage with flags (e.g., -l, -c) and discovery-relevant device or vendor strings.

Known false positives

Legitimate administrative activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.