Security tooling recon via defaults read and du -sh on macOS

Duo Tech@duotech

•updated Jul 14, 2026•1•0•3

Detects repeated execution of 'defaults read' or 'du -sh' commands within a one-hour window. These commands are commonly used for system information and file directory discovery, which may indicate reconnaissance activity by an attacker.