System Information Discovery Using sw_vers

Title: System Information Discovery Using sw_vers
Status: test
Description:Detects the use of "sw_vers" for system information discovery
References:
  -https://www.virustotal.com/gui/file/d3fa64f63563fe958b75238742d1e473800cb5f49f5cb79d38d4aa3c93709026/behavior
  -https://www.virustotal.com/gui/file/03b71eaceadea05bc0eea5cddecaa05f245126d6b16cfcd0f3ba0442ac58dab3/behavior
  -https://ss64.com/osx/sw_vers.html
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-12-20
modified:None
Tags:

• -'attack.discovery'
• -'attack.t1082'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection_image:
    Image|endswith: '/sw_vers'
  selection_options:
    CommandLine|contains:
      -'-buildVersion'
      -'-productName'
      -'-productVersion'

  condition:all of selection_*
Falsepositives:
  -Legitimate administrative activities
Level: medium