MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

ATT&CK techniques

Defense Evasion → Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1497.001System Checks
Cred Access
Discovery
- T1082System Information Discovery
- T1497.001System Checks
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags execution of the sysctl utility on macOS where the command line includes sysctl and specific sysctl namespaces (hw., kern., machdep.). Attackers commonly use this local system information discovery to tailor behavior and evade analysis or virtualization environments. Telemetry relied upon is process creation data with process path and full command line arguments.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

macOS Process Execution of system_profiler for System Discovery via Specific Data Types

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)

Pivot detection · T1082 · 9 related

Changelog

v2

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-sysctl-execution-for-system-hardware-kernel-discovery-6ff08e55

title: MacOS Sysctl Usage for System Discovery (hw., kern., machdep.)
id: c315ee44-6669-4fc0-a90d-6e6336e54757
status: test
description: This rule flags execution of the sysctl utility on macOS where the command line includes sysctl and specific sysctl namespaces (hw., kern., machdep.). Attackers commonly use this local system information discovery to tailor behavior and evade analysis or virtualization environments. Telemetry relied upon is process creation data with process path and full command line arguments.
references:
  - https://www.loobins.io/binaries/sysctl/#
  - https://evasions.checkpoint.com/techniques/macos.html
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/
  - https://objective-see.org/blog/blog_0x1E.html
  - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior
  - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-27
tags:
  - attack.stealth
  - attack.t1497.001
  - attack.discovery
  - attack.t1082
logsource:
  product: macos
  category: process_creation
detection:
  selection_img:
    - Image|endswith: /sysctl
    - CommandLine|contains: sysctl
  selection_cmd:
    CommandLine|contains:
      - hw.
      - kern.
      - machdep.
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL