macOS: Detect hdiutil Disk Image Mounting via attach or mount commands

title: "macOS: Detect hdiutil Disk Image Mounting via attach or mount commands"
id: e45d8468-326c-46e8-b5e6-460168ce3cf2
status: test
description: This rule identifies process executions of the hdiutil utility with command-line arguments indicating disk image mounting (e.g., 'attach ' or 'mount '). Attackers may use hdiutil to access or stage contents from disk images during initial access or collection workflows. It relies on macOS process creation telemetry including the executable path and the command line text.
references:
  - https://www.loobins.io/binaries/hdiutil/
  - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
  - https://ss64.com/mac/hdiutil.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-10
tags:
  - attack.initial-access
  - attack.collection
  - attack.t1566.001
  - attack.t1560.001
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /hdiutil
    CommandLine|contains:
      - "attach "
      - "mount "
  condition: selection
falsepositives:
  - Legitimate usage of hdiutil by administrators and users.
level: medium
license: DRL-1.1
related:
  - id: bf241472-f014-4f01-a869-96f99330ca8c
    type: derived