System Information Discovery Using system_profiler with Specific Data Types

SigmaHQ Detections@sigmaHQ

•updated Nov 1, 2024•1•0•25

This rule detects the execution of the `system_profiler` utility on macOS when specific data types are requested. These data types (SPApplicationsDataType, SPHardwareDataType, SPNetworkDataType, SPUSBDataType) have been observed in use by threat actors and malware for system information discovery and potentially for defense evasion by checking for virtualization software. The `system_profiler` command provides detailed hardware and software configuration information about the system.