MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
Flags macOS sysctl commands querying hw., kern., or machdep. values for system discovery.
- Product
- macos
- Category
- process_creation
- Author
- Pratinav Chandra (SigmaHQ), DRL 1.1
- Published
- 2024-05-27
- Updated
- 2026-07-31
ATT&CK techniques
Defense Evasion → DiscoveryRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags execution of the sysctl utility on macOS where the command line includes sysctl and specific sysctl namespaces (hw., kern., machdep.). Attackers commonly use this local system information discovery to tailor behavior and evade analysis or virtualization environments. Telemetry relied upon is process creation data with process path and full command line arguments.
Reporting behind it
- loobins.iohttps://www.loobins.io/binaries/sysctl/#
- evasions.checkpoint.comhttps://evasions.checkpoint.com/techniques/macos.html
- welivesecurity.comhttps://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
- sentinelone.comhttps://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- objective-see.orghttps://objective-see.org/blog/blog_0x1E.html
- virustotal.comhttps://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior
- virustotal.comhttps://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
id: c315ee44-6669-4fc0-a90d-6e6336e54757
status: test
description: This rule flags execution of the sysctl utility on macOS where the command line includes sysctl and specific sysctl namespaces (hw., kern., machdep.). Attackers commonly use this local system information discovery to tailor behavior and evade analysis or virtualization environments. Telemetry relied upon is process creation data with process path and full command line arguments.
references:
- https://www.loobins.io/binaries/sysctl/#
- https://evasions.checkpoint.com/techniques/macos.html
- https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
- https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
- https://objective-see.org/blog/blog_0x1E.html
- https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior
- https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-27
tags:
- attack.stealth
- attack.t1497.001
- attack.discovery
- attack.t1082
logsource:
product: macos
category: process_creation
detection:
selection_img:
- Image|endswith: /sysctl
- CommandLine|contains: sysctl
selection_cmd:
CommandLine|contains:
- hw.
- kern.
- machdep.
condition: all of selection_*
falsepositives:
- Legitimate administrative activities
level: medium
license: DRL-1.1
related:
- id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
type: derived