macOS.Gaslight system discovery via ps aux, system_profiler, and sw_vers

Ibrahim Saud@tektrix

•updated Jun 24, 2026•0•0•1

This rule detects the execution of multiple common macOS utilities ('ps', 'system_profiler', 'sw_vers', 'sysctl', 'uname') with specific command-line arguments often used for system information discovery. The rule identifies instances where these commands are executed by a single initiating process, excluding common shell processes, and flags executions originating from suspicious temporary or library paths.