System Information Discovery Using System_Profiler

Title: System Information Discovery Using System_Profiler
Status: test
Description:Detects the execution of "system_profiler" with specific "Data Types" that have been seen being used by threat actors and malware. It provides system hardware and software configuration information. This process is primarily used for system information discovery. However, "system_profiler" can also be used to determine if virtualization software is being run for defense evasion purposes.
References:
  -https://www.trendmicro.com/en_za/research/20/k/new-macos-backdoor-connected-to-oceanlotus-surfaces.html
  -https://www.sentinelone.com/wp-content/uploads/pdf-gen/1630910064/20-common-tools-techniques-used-by-macos-threat-actors-malware.pdf
  -https://ss64.com/mac/system_profiler.html
  -https://objective-see.org/blog/blog_0x62.html
  -https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  -https://gist.github.com/nasbench/9a1ba4bc7094ea1b47bc42bf172961af
Author: Stephen Lincoln `@slincoln_aiq` (AttackIQ)
Date: 2024-01-02
modified:None
Tags:

• -'attack.discovery'
• -'attack.stealth'
• -'attack.t1082'
• -'attack.t1497.001'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection_img:
Image|endswith:'/system_profiler' CommandLine|contains:'system_profiler'   selection_cmd:
    CommandLine|contains:
      -'SPApplicationsDataType'
      -'SPHardwareDataType'
      -'SPNetworkDataType'
      -'SPUSBDataType'

  condition:all of selection_*
Falsepositives:
  -Legitimate administrative activities
Level: medium