macOS hdiutil Disk Image Creation via Process Execution
Flags macOS executions of hdiutil with the 'create' option, consistent with disk image creation.
FreeReviewedSigma · Medium · v2
- Product
- macos
- Category
- process_creation
- Author
- Omar Khaled (@beacon_exe) (SigmaHQ), DRL 1.1
- Published
- 2024-08-10
- Updated
- 2026-07-31
What it detects
This rule identifies execution of the hdiutil utility when the command line includes the action to create a disk image. Attackers may use hdiutil to package files into disk images for storage, staging, or exfiltration. The detection relies on macOS process creation telemetry capturing the executed binary path and the associated command line arguments.
Reporting behind it
- loobins.iohttps://www.loobins.io/binaries/hdiutil/
- sentinelone.comhttps://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
- ss64.comhttps://ss64.com/mac/hdiutil.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-hdiutil-disk-image-creation-execution-1cf98dc2
title: macOS hdiutil Disk Image Creation via Process Execution
id: b538cb09-fa51-42b7-9cbd-d15652c96d92
status: test
description: This rule identifies execution of the hdiutil utility when the command line includes the action to create a disk image. Attackers may use hdiutil to package files into disk images for storage, staging, or exfiltration. The detection relies on macOS process creation telemetry capturing the executed binary path and the associated command line arguments.
references:
- https://www.loobins.io/binaries/hdiutil/
- https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
- https://ss64.com/mac/hdiutil.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-10
tags:
- attack.exfiltration
logsource:
product: macos
category: process_creation
detection:
selection:
Image|endswith: /hdiutil
CommandLine|contains: create
condition: selection
falsepositives:
- Legitimate usage of hdiutil by administrators and users.
level: medium
license: DRL-1.1
related:
- id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae
type: derived