system_profiler

List all available sub-systems to get information from.

system_profiler -listDataTypes

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using System_Profiler: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Jamf Protect: Detect system_profiler activity that gathers system information: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml

macosbin.com/bin/system_profiler

ss64.com/osx/system_profiler.html

Prints an overview of the hardware of the current machine, including its model name and serial number.

system_profiler SPHardwareDataType

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using System_Profiler: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Jamf Protect: Detect system_profiler activity that gathers system information: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml

macosbin.com/bin/system_profiler

ss64.com/osx/system_profiler.html

Prints an overview of the software of the current machine, including the exact macOS version number.

system_profiler SPSoftwareDataType

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using System_Profiler: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Jamf Protect: Detect system_profiler activity that gathers system information: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml

macosbin.com/bin/system_profiler

ss64.com/osx/system_profiler.html

Prints the currently active version of the Xcode developer tools and SDK.

system_profiler SPDeveloperToolsDataType

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using System_Profiler: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Jamf Protect: Detect system_profiler activity that gathers system information: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml

macosbin.com/bin/system_profiler

ss64.com/osx/system_profiler.html

Prints power and battery information, including the current AC wattage and battery cycle count.

system_profiler SPPowerDataType

Evidence

Upstream reference

Environment

Local host

Compatibility

Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.

Native

Discovery

Detection

System Information Discovery Using System_Profiler: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_system_profiler_discovery.yml

Jamf Protect: Detect system_profiler activity that gathers system information: github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/system_profiler_activity

Refs

github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/system_profiler.yml

macosbin.com/bin/system_profiler

ss64.com/osx/system_profiler.html