Detectionmediumtest

System Information Discovery Using Ioreg

Detects the use of "ioreg" which will show I/O Kit registry information. This process is used for system information discovery. It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Joseliyo SanchezCreated Wed Dec 20Updated Tue Jan 022d5e7a8b-f484-4a24-945d-7f0efd52eab0macos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    # Examples:
    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'VirtualBox' -e 'Oracle' -e 'VMware' -e 'Parallels' | wc -l
    #   /usr/sbin/ioreg ioreg -rd1 -w0 -c AppleAHCIDiskDriver
    #   /bin/bash /bin/sh -c ioreg -l | grep -e 'USB Vendor Name'
    #   ioreg -rd1 -c IOPlatformExpertDevice | awk '/IOPlatformSerialNumber/ { split($0, line, \"\\\"\"); printf(\"%s\", line[4]); }
    selection_img:
        - Image|endswith: '/ioreg'
        - CommandLine|contains: 'ioreg'
    selection_cmd1:
        CommandLine|contains:
            - '-l'
            - '-c'
    selection_cmd2:
        CommandLine|contains:
            - 'AppleAHCIDiskDriver'
            - 'IOPlatformExpertDevice'
            - 'Oracle'
            - 'Parallels'
            - 'USB Vendor Name'
            - 'VirtualBox'
            - 'VMware'
    condition: all of selection_*