Query: rule covering Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides
Matching passage: Sigma rule: Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides. Logsource: macos / process_creation. Rule: title: System Information Discovery Via Sysctl - MacOS id: 6ff08e55-ea53-4f27-94a1-eff92e6d9d5c status: test description: 'Detects the execution of "sysctl" with specific arguments that have been used by threat actors and malware. It provides system hardware information. This process is primarily used to detect and avoid virtualization and analysis environments. ' references: - https://www.loobins.io/binaries/sysctl/# - https://evasions.checkpoint.com/techniques/macos.html - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/ - https://www.sentinelone.com/labs/20-common-tools-techniques-used-by-macos-threat-actors-malware/ - https://objective-see.org/blog/blog_0x1E.html - https://www.virustotal.com/gui/file/1c547a064494a35d6b5e6b459de183ab2720a22725e082bed6f6629211f7abc1/behavior - https://www.virustotal.com/gui/file/b4b1fc65f87b3dcfa35e2dbe8e0a34ad9d8a400bec332025c0a2e200671038aa/behavior author: Pratinav Chandra date: 2024-05-27 tags: - attack.stealth - attack.t1497.001 - attack.discovery - attack.t1082 logsource: product: macos category: process_creation detection: selection_img: - Image|endswith: /sysctl - CommandLine|contains: sysctl selection_cmd: CommandLine|contains: - hw. - kern. - machdep. condition: all of selection_* falsepositives: - Legitimate administrative activities level: medium
Near-miss passage: Sigma rule: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution. Logsource: windows / registry_set. Rule: title: Usage of Renamed Sysinternals Tools - RegistrySet id: 8023f872-3f1d-4301-a384-801889917ab4 related: - id: 25ffa65d-76d8-4da5-a832-3f2b0136e133 type: derived - id: f50f3c09-557d-492d-81db-9064a8d4e211 type: similar status: test description: Detects non-sysinternals tools setting the "accepteula" key which normally is set on sysinternals tool execution references: - Internal Research author: Nasreddine Bencherchali (Nextron Systems) date: 2022-08-24 modified: 2026-06-29 tags: - attack.resource-development - attack.t1588.002 logsource: product: windows category: registry_set detection: selection: TargetObject|contains: - \PsExec - \ProcDump - \Handle - \LiveKd - \Process Explorer - \PsLoglist - \PsPasswd - \Active Directory Explorer TargetObject|endswith: \EulaAccepted filter_main_image_names: Image|endswith: - \PsExec.exe - \PsExec64.exe - \PsExec64a.exe - \procdump.exe - \procdump64.exe - \procdump64a.exe - \handle.exe - \handle64.exe - \handle64a.exe - \livekd.exe - \livekd64.exe - \procexp.exe - \procexp64.exe - \procexp64a.exe - \psloglist.exe - \psloglist64.exe - \psloglist64a.exe - \pspasswd.exe - \pspasswd64.exe - \pspasswd64a.exe - \ADExplorer.exe - \ADExplorer64.exe - \ADExplorer64a.exe filter_optional_null: Image: null condition: selection and not 1 of filter_main_* and not 1 of filter_optional_* falsepositives: - Unlikely level: high