macOS CountLoader system profiling via sw_vers/system_profiler/ioreg

Duo Tech@duotech

•updated Aug 4, 2026•12•0•5

Detects at least two of three macOS profiling subprocess commands (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 -c IOPlatformExpertDevice) spawned by the same parent process within a 2-minute window, consistent with the CountLoader macOS variant's system-profiling routine.