macOS: Disabling Time Machine via tmutil process execution

Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.

FreeUnreviewedSigmamediumv1

macos-disabling-time-machine-via-tmutil-process-execution-2c95fa8a

title: "macOS: Disabling Time Machine via tmutil process execution"
id: 7f87c40d-f2db-493c-9f77-475145ed8941
status: test
description: This rule identifies execution of tmutil on macOS where the command line includes a disable action. Disabling Time Machine can prevent automated backups, which may hinder recovery and availability after compromise. Telemetry relies on process creation data including the executable path and the full command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    - Image|endswith: /tmutil
    - CommandLine|contains: tmutil
  selection_cmd:
    CommandLine|contains: disable
  condition: all of selection_*
falsepositives:
  - Legitimate administrator activity
level: medium
license: DRL-1.1
related:
  - id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da
    type: derived

What it detects

This rule identifies execution of tmutil on macOS where the command line includes a disable action. Disabling Time Machine can prevent automated backups, which may hinder recovery and availability after compromise. Telemetry relies on process creation data including the executable path and the full command line.

Known false positives

Legitimate administrator activity

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.