macOS System Network Connections Discovery via who/w/last/lsof/netstat

title: macOS System Network Connections Discovery via who/w/last/lsof/netstat
id: 3a183ea3-1a95-42e6-ba1d-dd4926490bed
status: test
description: "This rule identifies process executions on macOS where the command path ends with common system network or session discovery utilities: who, w, last, lsof, or netstat. Attackers often use these tools to enumerate active connections, logged-in users, or network-relevant information to support further discovery and targeting. It relies on process creation telemetry, matching the terminating command name in the process image path."
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1049/T1049.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_network_connections_discovery.yml
author: Daniil Yugoslavskiy, oscd.community, Huntrule Team
date: 2020-10-19
modified: 2022-12-28
tags:
  - attack.discovery
  - attack.t1049
logsource:
  category: process_creation
  product: macos
detection:
  selection:
    Image|endswith:
      - /who
      - /w
      - /last
      - /lsof
      - /netstat
  condition: selection
falsepositives:
  - Legitimate activities
level: informational
license: DRL-1.1
related:
  - id: 9a7a0393-2144-4626-9bf1-7c2f5a7321db
    type: derived