{"id":"6ff08e55-ea53-4f27-94a1-eff92e6d9d5c","title":"System Information Discovery Via Sysctl - MacOS","description":"Detects the execution of \"sysctl\" with specific arguments that have been used by threat actors and malware. It provides system hardware information.\nThis process is primarily used to detect and avoid virtualization and analysis environments.\n","author":"Pratinav Chandra","status":"test","level":"medium","date":"2024-05-27","modified":"","tags":["attack.stealth","attack.t1497.001","attack.discovery","attack.t1082"],"technique_ids":["T1082","T1497.001"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate administrative activities"],"references":["https://www.loobins.io/binaries/sysctl/#","https://evasions.checkpoint.com/techniques/macos.html","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/","https://objective-see.org/blog/blog_0x1E.html","https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior","https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior"],"source_path":"rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml","source_sha256":"0961e1175b64234d62ee898136dbde193840e4188b1ba276e68d4d031cb6106e","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_sysctl_discovery.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: System Information Discovery Via Sysctl - MacOS\nid: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c\nstatus: test\ndescription: |\n    Detects the execution of \"sysctl\" with specific arguments that have been used by threat actors and malware. It provides system hardware information.\n    This process is primarily used to detect and avoid virtualization and analysis environments.\nreferences:\n    - https://www.loobins.io/binaries/sysctl/#\n    - https://evasions.checkpoint.com/techniques/macos.html\n    - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/\n    - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/\n    - https://objective-see.org/blog/blog_0x1E.html\n    - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior\n    - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior\nauthor: Pratinav Chandra\ndate: 2024-05-27\ntags:\n    - attack.stealth\n    - attack.t1497.001\n    - attack.discovery\n    - attack.t1082\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection_img:\n        - Image|endswith: '/sysctl'\n        - CommandLine|contains: 'sysctl'\n    selection_cmd:\n        CommandLine|contains:\n            - 'hw.'\n            - 'kern.'\n            - 'machdep.'\n    condition: all of selection_*\nfalsepositives:\n    - Legitimate administrative activities\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1082","id":"T1082","name":"System Information Discovery","page":"techniques/enterprise/T1082/"},{"key":"enterprise/T1497.001","id":"T1497.001","name":"System Checks","page":"techniques/enterprise/T1497.001/"}],"data_path":"data/detection-rules/6ff08e55-ea53-4f27-94a1-eff92e6d9d5c.json","kind":"sigma"}