macOS: Detect tmutil Adding Time Machine Exclusions (addexclusion)

Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.

FreeUnreviewedSigmamediumv1

macos-detect-tmutil-adding-time-machine-exclusions-addexclusion-9acf45ed

title: "macOS: Detect tmutil Adding Time Machine Exclusions (addexclusion)"
id: a1e1e488-6e24-4b0d-a38a-08b789d2af75
status: test
description: This rule flags process executions of tmutil where the command line includes “addexclusion” to add a new Time Machine file/path exclusion. Attackers can use Time Machine exclusion changes to prevent specific files from being included in backups. The detection relies on macOS process creation telemetry capturing the executing image name ending with “/tmutil” and the command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    - Image|endswith: /tmutil
    - CommandLine|contains: tmutil
  selection_cmd:
    CommandLine|contains: addexclusion
  condition: all of selection_*
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: 9acf45ed-3a26-4062-bf08-56857613eb52
    type: derived

What it detects

This rule flags process executions of tmutil where the command line includes “addexclusion” to add a new Time Machine file/path exclusion. Attackers can use Time Machine exclusion changes to prevent specific files from being included in backups. The detection relies on macOS process creation telemetry capturing the executing image name ending with “/tmutil” and the command line arguments.

Known false positives

Legitimate administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.