# sysctl

> Get macOS hardware model information.

Gets the macOS hardware information, which can be used to determine whether the target macOS host is running on a physical or virtual machine.

- Page: https://loobins.io/binaries/sysctl/
- Author: Cedric Owens (@cedowens)
- Created: 2023-04-20
- Tactics: Discovery

## Paths

- `/usr/sbin/sysctl`

## Example Use Cases

### Use sysctl to gather macOS hardware info.

sysctl can be used to gather interesting macOS host data, including hardware information, memory size, logical cpu information, etc.

```bash
sysctl -n hw.model
```

- Tactics: Discovery
- Tags: bash, oneliner

## Detections

- [Jamf Protect: Detect activity related to sysctl in an interactive shell](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/sysctl_activity)

## Resources

- [Evasions: macOS](https://evasions.checkpoint.com/src/MacOS/macos.html)