macOS System Network Configuration Discovery

SigmaHQ Detections@sigmaHQ

•updated Aug 29, 2024•1•0•26

Detects the execution of common macOS command-line utilities used for enumerating local network configuration and firewall settings. This includes tools like 'arp', 'ifconfig', 'netstat', 'networksetup', and 'socketfilterfw', as well as 'defaults' when querying specific firewall preferences.