CatalogLOOBins

ORCHARD · Tool

sysctl

1 techniquemacOSLOOBinsGPL-3.0

Use sysctl to gather macOS hardware info.

DiscoverymacOS

sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.

sysctl -n hw.model
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Discovery
Detection
Jamf Protect: Detect activity related to sysctl in an interactive shell: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sysctl_activity