Techniques › T1480 › AN1553
AN1553 Analytic 1553
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>macOS environmental validation behavioral chain: (1) System profiling through system_profiler, sysctl, and hardware discovery commands, (2) Network interface and configuration enumeration for geolocation and network environment validation, (3) Application installation and version discovery for software environment fingerprinting, (4) Security feature detection (SIP, Gatekeeper, XProtect status), (5) Conditional payload execution based on macOS-specific environmental criteria and System Integrity Protection bypass validation</p>
- Detects
- T1480 Execution Guardrails
- Part of
- DET0562 Multi-Platform Execution Guardrails Environmental Validation Detection Strategy
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | process execution events for system discovery utilities (system_profiler, sysctl, networksetup, ioreg) with parameter analysis | DC0032 Process Creation |
| fs:fileevents | File system access events with kFSEventStreamEventFlagItemRemoved, kFSEventStreamEventFlagItemRenamed flags for environmental artifact collection (/System/Library, /usr/sbin, plist files) | DC0055 File Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
MacOSDiscoveryTools | macOS-specific system discovery utilities commonly used for environmental validation |
SecurityFeatureEnumeration | Security features and configurations typically validated by macOS execution guardrails |
HardwareFingerprintBaseline | Normal hardware discovery patterns to distinguish from environmental validation attempts |
SIPBypassIndicators | Patterns indicating attempts to validate or bypass System Integrity Protection |