{"id":"2d5e7a8b-f484-4a24-945d-7f0efd52eab0","title":"System Information Discovery Using Ioreg","description":"Detects the use of \"ioreg\" which will show I/O Kit registry information.\nThis process is used for system information discovery.\nIt has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.\n","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-12-20","modified":"2024-01-02","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administrative activities"],"references":["https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior","https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior","https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior","https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html"],"source_path":"rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml","source_sha256":"a9736d6aa8722272ded680524254e4679960ee7d20e4f2116dfef11edf7d3992","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Information Discovery Using Ioreg\nid: 2d5e7a8b-f484-4a24-945d-7f0efd52eab0\nstatus: test\ndescription: |\n    Detects the use of \"ioreg\" which will show I/O Kit registry information.\n    This process is used for system information discovery.\n    It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.\nreferences:\n    - https://www.virustotal.com/gui/file/0373d78db6c3c0f6f6dcc409821bf89e1ad8c165d6f95c5c80ecdce2219627d7/behavior\n    - https://www.virustotal.com/gui/file/4ffdc72d1ff1ee8228e31691020fc275afd1baee5a985403a71ca8c7bd36e2e4/behavior\n    - https://www.virustotal.com/gui/file/5907d59ec1303cfb5c0a0f4aaca3efc0830707d86c732ba6b9e842b5730b95dc/behavior\n    - https://www.trendmicro.com/en_ph/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\nmodified: 2024-01-02\ntags:\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # Examples:\n    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'VirtualBox' -e 'Oracle' -e 'VMware' -e 'Parallels' | wc -l\n    #   /usr/sbin/ioreg ioreg -rd1 -w0 -c AppleAHCIDiskDriver\n    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'USB Vendor Name'\n    #   ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \\\"\\\\\\\"\\\"); printf(\\\"%s\\\", line[4]); }\n    selection_img:\n        - Image|endswith: '/ioreg'\n        - CommandLine|contains: 'ioreg'\n    selection_cmd1:\n        CommandLine|contains:\n            - '-l'\n            - '-c'\n    selection_cmd2:\n        CommandLine|contains:\n            - 'AppleAHCIDiskDriver'\n            - 'IOPlatformExpertDevice'\n            - 'Oracle'\n            - 'Parallels'\n            - 'USB Vendor Name'\n            - 'VirtualBox'\n            - 'VMware'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administrative activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/2d5e7a8b-f484-4a24-945d-7f0efd52eab0.json","kind":"sigma"}