macOS hdiutil Disk Image Creation Execution

Flags macOS executions of hdiutil with the 'create' option, consistent with disk image creation.

FreeUnreviewedSigmamediumv1

macos-hdiutil-disk-image-creation-execution-1cf98dc2

title: macOS hdiutil Disk Image Creation Execution
id: b538cb09-fa51-42b7-9cbd-d15652c96d92
status: test
description: This rule matches process executions of the hdiutil utility where the command line contains the 'create' argument, indicating disk image creation activity. Creating disk images can be used to package files for distribution or exfiltration and may be used to stage data. Detection relies on macOS process creation telemetry, specifically the executable path and command-line content.
references:
  - https://www.loobins.io/binaries/hdiutil/
  - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
  - https://ss64.com/mac/hdiutil.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-10
tags:
  - attack.exfiltration
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /hdiutil
    CommandLine|contains: create
  condition: selection
falsepositives:
  - Legitimate usage of hdiutil by administrators and users.
level: medium
license: DRL-1.1
related:
  - id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae
    type: derived

What it detects

This rule matches process executions of the hdiutil utility where the command line contains the 'create' argument, indicating disk image creation activity. Creating disk images can be used to package files for distribution or exfiltration and may be used to stage data. Detection relies on macOS process creation telemetry, specifically the executable path and command-line content.

Known false positives

Legitimate usage of hdiutil by administrators and users.

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.