macOS System Information Discovery via sw_vers with Product/Build Version Flags

Detects sw_vers executions on macOS that request product name/version or build version details.

FreeUnreviewedSigmamediumv1

macos-system-information-discovery-via-sw-vers-with-product-build-version-flags-5de06a6f

title: macOS System Information Discovery via sw_vers with Product/Build Version Flags
id: c228de74-57bb-4272-8382-9ce3f8895321
status: test
description: This rule flags macOS process executions of the sw_vers utility when the command line includes product or build version-related flags. Attackers may use system information discovery to profile the host for follow-on targeting and to adapt malware behavior. It relies on process creation telemetry, specifically the executed image path ending with sw_vers and command-line arguments containing -productName, -productVersion, or -buildVersion.
references:
  - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
  - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior
  - https://ss64.com/osx/sw_vers.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: macos
  category: process_creation
detection:
  selection_image:
    Image|endswith: /sw_vers
  selection_options:
    CommandLine|contains:
      - -buildVersion
      - -productName
      - -productVersion
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 5de06a6f-673a-4fc0-8d48-bcfe3837b033
    type: derived

What it detects

This rule flags macOS process executions of the sw_vers utility when the command line includes product or build version-related flags. Attackers may use system information discovery to profile the host for follow-on targeting and to adapt malware behavior. It relies on process creation telemetry, specifically the executed image path ending with sw_vers and command-line arguments containing -productName, -productVersion, or -buildVersion.

Known false positives

Legitimate administrative activities

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.