CrashStealer macOS security tooling enumeration via process grep and system_profiler

Duo Tech@duotech

•updated Jul 14, 2026•1•0•11

This rule detects potential reconnaissance activity on macOS by monitoring for the execution of 'system_profiler' to gather system application data or the use of 'grep' to search for process information (ps). Such activity is often associated with initial discovery phases where an adversary gathers information about the target system.