macOS: Time Machine Exclusion Added via tmutil addexclusion
Alerts on tmutil commands that add new Time Machine exclusions to skip backing up selected files.
- Product
- macos
- Category
- process_creation
- Author
- Pratinav Chandra (SigmaHQ), DRL 1.1
- Published
- 2024-05-29
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags process executions of tmutil on macOS where a Time Machine exclusion is being added using the addexclusion argument. Attackers may use this to prevent specific files or paths from being included in backups, reducing the likelihood of recovery and forensic visibility. Detection relies on process creation telemetry, matching the tmutil binary and the presence of the addexclusion command-line string.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- loobins.iohttps://www.loobins.io/binaries/tmutil/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS: Time Machine Exclusion Added via tmutil addexclusion"
id: a1e1e488-6e24-4b0d-a38a-08b789d2af75
status: test
description: This rule flags process executions of tmutil on macOS where a Time Machine exclusion is being added using the addexclusion argument. Attackers may use this to prevent specific files or paths from being included in backups, reducing the likelihood of recovery and forensic visibility. Detection relies on process creation telemetry, matching the tmutil binary and the presence of the addexclusion command-line string.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- https://www.loobins.io/binaries/tmutil/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: macos
detection:
selection_img:
- Image|endswith: /tmutil
- CommandLine|contains: tmutil
selection_cmd:
CommandLine|contains: addexclusion
condition: all of selection_*
falsepositives:
- Legitimate administrator activity
level: medium
license: DRL-1.1
related:
- id: 9acf45ed-3a26-4062-bf08-56857613eb52
type: derived