macOS: Disable Time Machine via tmutil
Flags macOS tmutil commands that include disabling Time Machine to stop automated backups.
- Product
- macos
- Category
- process_creation
- Author
- Pratinav Chandra (SigmaHQ), DRL 1.1
- Published
- 2024-05-29
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule identifies attempts to disable Time Machine using the native macOS utility tmutil. Disabling backups can hinder recovery and reduce visibility into system changes, which may be part of an attacker’s impact strategy. The detection relies on process creation telemetry that includes the executable path or command usage containing tmutil and the word disable in the command line.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- loobins.iohttps://www.loobins.io/binaries/tmutil/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: "macOS: Disable Time Machine via tmutil"
id: 7f87c40d-f2db-493c-9f77-475145ed8941
status: test
description: This rule identifies attempts to disable Time Machine using the native macOS utility tmutil. Disabling backups can hinder recovery and reduce visibility into system changes, which may be part of an attacker’s impact strategy. The detection relies on process creation telemetry that includes the executable path or command usage containing tmutil and the word disable in the command line.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- https://www.loobins.io/binaries/tmutil/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: macos
detection:
selection_img:
- Image|endswith: /tmutil
- CommandLine|contains: tmutil
selection_cmd:
CommandLine|contains: disable
condition: all of selection_*
falsepositives:
- Legitimate administrator activity
level: medium
license: DRL-1.1
related:
- id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da
type: derived