Techniques › T1120 › AN1355
AN1355 Analytic 1355
macOS · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Execution of system utilities like 'system_profiler' and 'ioreg' to enumerate hardware components or USB devices, particularly if followed by clipboard, file, or network activity.</p>
- Detects
- T1120 Peripheral Device Discovery
- Part of
- DET0491 Peripheral Device Enumeration via System Utilities and API Calls
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| macos:unifiedlog | process exec | DC0032 Process Creation |
| macos:osquery | usb_devices | DC0054 Drive Access |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BinaryList | Commands like 'system_profiler SPUSBDataType', 'ioreg -p IOUSB' that may indicate enumeration |
TimeWindow | Temporal grouping of enumeration with follow-on activity (e.g., clipboard capture, exfiltration) |