macOS Process Creation: hdiutil Used to Attach or Mount Disk Images
Flags hdiutil usage on macOS when command lines indicate disk image attachment or mounting.
- Product
- macos
- Category
- process_creation
- Author
- Omar Khaled (@beacon_exe) (SigmaHQ), DRL 1.1
- Published
- 2024-08-10
- Updated
- 2026-07-31
ATT&CK techniques
Initial Access → CollectionRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact
What it detects
This rule flags macOS process executions where the hdiutil binary is invoked with command-line arguments containing disk image attachment or mounting indicators. Attackers may use built-in disk image tooling to access or stage files without introducing third-party binaries. Detection relies on process creation telemetry, specifically the executable path ending in /hdiutil and matching command-line substrings for attach or mount.
Reporting behind it
- loobins.iohttps://www.loobins.io/binaries/hdiutil/
- sentinelone.comhttps://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
- ss64.comhttps://ss64.com/mac/hdiutil.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS Process Creation: hdiutil Used to Attach or Mount Disk Images"
id: e45d8468-326c-46e8-b5e6-460168ce3cf2
status: test
description: This rule flags macOS process executions where the hdiutil binary is invoked with command-line arguments containing disk image attachment or mounting indicators. Attackers may use built-in disk image tooling to access or stage files without introducing third-party binaries. Detection relies on process creation telemetry, specifically the executable path ending in /hdiutil and matching command-line substrings for attach or mount.
references:
- https://www.loobins.io/binaries/hdiutil/
- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
- https://ss64.com/mac/hdiutil.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-10
tags:
- attack.initial-access
- attack.collection
- attack.t1566.001
- attack.t1560.001
logsource:
product: macos
category: process_creation
detection:
selection:
Image|endswith: /hdiutil
CommandLine|contains:
- "attach "
- "mount "
condition: selection
falsepositives:
- Legitimate usage of hdiutil by administrators and users.
level: medium
license: DRL-1.1
related:
- id: bf241472-f014-4f01-a869-96f99330ca8c
type: derived