macOS System Information Discovery via sw_vers with product/build flags

Detects sw_vers executions on macOS that request product name/version or build version details.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-12-20
Updated: 2026-07-31

ATT&CK techniques

Discovery

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
- T1082System Information Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process executions of the macOS sw_vers utility where the command line includes product or version/build flags (e.g., -productVersion, -productName, -buildVersion). Attackers often use local system interrogation to tailor subsequent actions and verify environment details. It relies on process creation telemetry, specifically the executable path ending in /sw_vers and the presence of the specified command-line arguments.

Reporting behind it

Related detections9 linkedT1082 — drag to rearrange

Suspicious System Profiler Hardware Enumeration (via process_creation)

Suspicious Hardware Inventory Discovery via WMIC Device Class Queries (via process_creation)

Suspicious macOS Hardware Identifier Reconnaissance via ioreg (via process_creation)

Suspicious Encoded PowerShell Host Reconnaissance via Get-ComputerInfo via ps_script

Suspicious Host Recon via ConvertFrom-Csv and ConvertTo-Json

Suspicious Java Process Spawning Reconnaissance Commands via Cleo MFT (via process_creation)

Suspicious Reconnaissance Commands Spawned by Samsung MagicINFO Server

Suspicious macOS Download History Query via sqlite3

Suspicious Security Policy Export via SecEdit (via process_creation)

macOS System Information Discovery via sw_vers with product/build flags

Pivot detection · T1082 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-system-information-discovery-via-sw-vers-with-product-build-version-flags-5de06a6f

title: macOS System Information Discovery via sw_vers with product/build flags
id: c228de74-57bb-4272-8382-9ce3f8895321
status: test
description: This rule identifies process executions of the macOS sw_vers utility where the command line includes product or version/build flags (e.g., -productVersion, -productName, -buildVersion). Attackers often use local system interrogation to tailor subsequent actions and verify environment details. It relies on process creation telemetry, specifically the executable path ending in /sw_vers and the presence of the specified command-line arguments.
references:
  - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
  - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior
  - https://ss64.com/osx/sw_vers.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-12-20
tags:
  - attack.discovery
  - attack.t1082
logsource:
  product: macos
  category: process_creation
detection:
  selection_image:
    Image|endswith: /sw_vers
  selection_options:
    CommandLine|contains:
      - -buildVersion
      - -productName
      - -productVersion
  condition: all of selection_*
falsepositives:
  - Legitimate administrative activities
level: medium
license: DRL-1.1
related:
  - id: 5de06a6f-673a-4fc0-8d48-bcfe3837b033
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL