UUID Extraction via Ioreg (FlutterShell)

Ethan Andrews@eandrews

•updated Jun 2, 2026•1•0•4

This rule detects attempts to extract the system's hardware UUID using the `ioreg` command, specifically looking for arguments used by the FlutterShell backdoor to query `IOPlatformExpertDevice` and `IOPlatformUUID`. This activity is indicative of system information discovery, often performed by malware to fingerprint a compromised host.