Elastic Security Detection Rules

System and Network Configuration Check

Last updated 2 days ago on 2026-02-09
Created 12 days ago on 2026-01-30

About

Detects when the SystemConfiguration preferences plist file is accessed by an unusual or suspicious process. This may indicate an attempt to gain situational awareness on a target system by reading network configuration details.
Tags
Domain: EndpointOS: macOSUse Case: Threat DetectionTactic: DiscoveryData Source: Elastic DefendLanguage: eql
Severity
medium
Risk Score
47
MITRE ATT&CK™

Discovery (TA0007)(external, opens in a new tab or window)

↳ System Information Discovery (T1082)(external, opens in a new tab or window)

↳ System Network Configuration Discovery (T1016)(external, opens in a new tab or window)

License
Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type
Event Correlation Rule
Integration Pack
Prebuilt Security Detection Rules
Index Patterns
logs-endpoint.events.file-*
Related Integrations

endpoint(external, opens in a new tab or window)

Query
text code block:
file where host.os.type == "macos" and event.action == "open" and 
  file.path like "/Library/Preferences/SystemConfiguration/preferences.plist" and
  (process.name like~ ("python*", "osascript", "perl", "ruby", "node") or 
   process.executable like ("/Users/Shared/*", "/tmp/*", "/private/tmp/*", "/var/tmp/*", "/private/var/tmp/*")) and
  not Effective_process.executable like "/Applications/Docker.app/Contents/MacOS/Docker"

Install detection rules in Elastic Security

Detect System and Network Configuration Check in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).