System Information Discovery Using sw_vers on macOS

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•0•20

This rule detects the execution of the 'sw_vers' command-line utility on macOS systems when specific arguments are used to query system information. The arguments monitored include '-buildVersion', '-productName', and '-productVersion', which are commonly used for system information discovery.