{"id":"5de06a6f-673a-4fc0-8d48-bcfe3837b033","title":"System Information Discovery Using sw_vers","description":"Detects the use of \"sw_vers\" for system information discovery","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-12-20","modified":"","tags":["attack.discovery","attack.t1082"],"technique_ids":["T1082"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administrative activities"],"references":["https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior","https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior","https://ss64.com/osx/sw_vers.html"],"source_path":"rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml","source_sha256":"efa007105db7171f731b5d7f8e265dcb1e6993c54ac051c7d26304f865b7d6a2","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_swvers_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Information Discovery Using sw_vers\nid: 5de06a6f-673a-4fc0-8d48-bcfe3837b033\nstatus: test\ndescription: Detects the use of \"sw_vers\" for system information discovery\nreferences:\n    - https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior\n    - https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior\n    - https://ss64.com/osx/sw_vers.html\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-12-20\ntags:\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    # VT Query: 'behavior_processes:\"sw_vers\" and (behavior_processes:\"-productVersion\" or behavior_processes:\"-productName\" or behavior_processes:\"-buildVersion\") tag:dmg p:5+'\n    selection_image:\n        Image|endswith: '/sw_vers'\n    selection_options:\n        CommandLine|contains:\n            - '-buildVersion'\n            - '-productName'\n            - '-productVersion'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administrative activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"}],"data_path":"data/detection-rules/5de06a6f-673a-4fc0-8d48-bcfe3837b033.json","kind":"sigma"}