Detectionmediumtest

Disk Image Mounting Via Hdiutil - MacOS

Detects the execution of the hdiutil utility in order to mount disk images.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Omar KhaledCreated Sat Aug 10bf241472-f014-4f01-a869-96f99330ca8cmacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: /hdiutil
        CommandLine|contains:
            - 'attach '
            - 'mount '
    condition: selection

False Positives

Legitimate usage of hdiutil by administrators and users.

References

MITRE ATT&CK

Tactics

TA0001 · Initial Access TA0009 · Collection

Sub-techniques

T1566.001 · Spearphishing Attachment T1560.001 · Archive via Utility

Rule Metadata

Rule ID

bf241472-f014-4f01-a869-96f99330ca8c

Status

test

Level

medium

Type

Detection

Created

Sat Aug 10

Author

Omar Khaled

Path

rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml

Raw Tags

attack.initial-accessattack.collectionattack.t1566.001attack.t1560.001

View on GitHub