Sigma medium test sigma

System Information Discovery Using System_Profiler

Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.

View Source

Detection Logic

{
  "selection_img": [
    {
      "Image
| endswith": "/system_profiler"
    },
    {
      "CommandLine
| contains": "system_profiler"
    }
  ],
  "selection_cmd": {
    "CommandLine
| contains": [
      "SPApplicationsDataType",
      "SPHardwareDataType",
      "SPNetworkDataType",
      "SPUSBDataType"
    ]
  },
  "condition": "all of selection_*"
}

False Positives

⚠ Legitimate administrative activities

Field Validations

Loading…

Comments (0)

Loading comments...