ioreg

The following command will display a list of keys that contain "CGSSession". If the key "CGSSessionScreenIsLocked" is present, the screen is actively locked.

ioreg -n Root -d1 -a | grep CGSSession

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using Ioreg: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml

Jamf Protect: Ioreg used to detect if the screen is locked: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml

evasions.checkpoint.com/src/MacOS/macos.html

github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520

Check the output of this command (specifically the IOPlatformSerialNumber, board-id, and manufacturer fields) to check whether or not this host is in a virtual machine.

ioreg -rd1 -c IOPlatformExpertDevice

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery, Collection

Detection

System Information Discovery Using Ioreg: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml

Jamf Protect: Ioreg used to detect if the screen is locked: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml

evasions.checkpoint.com/src/MacOS/macos.html

github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520

Grep for "USB Vendor Name" values to view USB vendor names. On virtualized hardware these values may contain the hypervisor name such as "VirtualBox". This is an additional way to check for virtualization.

ioreg -rd1 -c IOUSBHostDevice

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery, Collection

Detection

System Information Discovery Using Ioreg: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml

Jamf Protect: Ioreg used to detect if the screen is locked: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml

evasions.checkpoint.com/src/MacOS/macos.html

github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520

Grep for "virtual box", "oracle", and "vmware" from the output of the ioreg -l command. This is an additional way to check for virtualization.

ioreg -l

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery, Collection

Detection

System Information Discovery Using Ioreg: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_ioreg_discovery.yml

Jamf Protect: Ioreg used to detect if the screen is locked: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/lockscreen_check

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/ioreg.yml

evasions.checkpoint.com/src/MacOS/macos.html

github.com/cedowens/SwiftBelt-JXA/blob/main/SwiftBelt-JXA.js#520