Anvilogic high experimental spl
System Information Discovery via sw_vers - macOS [splunk-edr]
sw_vers is a macOS command-line utility that displays the operating system version, build number, and computer name. A threat actor could abuse it to fingerprint a macOS system, gathering OS version information for tailoring exploits or identifying specific vulnerabilities. This use case detects sw_vers executions querying OS system version, build number, or product version.
Detection Logic
`get_endpoint_data` `get_endpoint_data_edr` TERM(sysctl) ("hw."
OR "kern."
OR "machdep.") `group_events(host,1)`Field Validations
Loading…
Comments (0)
Loading comments...