macOS: JAMF CLI (jamf) execution for account and MDM management
Flags macOS executions of the JAMF CLI with command-line actions tied to account, MDM, and framework changes.
FreeReviewedSigma · Low · v2
- Product
- macos
- Category
- process_creation
- Author
- Jay Pandit (SigmaHQ), DRL 1.1
- Published
- 2023-08-22
- Updated
- 2026-07-31
What it detects
This rule identifies process executions where the macOS binary path ends with '/jamf' and the command line contains specific JAMF CLI subcommands. Attackers could abuse the JAMF tool to create or modify user accounts and manage or remove MDM-related components, potentially bypassing security controls. Detection relies on macOS process creation telemetry, including the executable path and command-line arguments.
Reporting behind it
- github.comhttps://github.com/MythicAgents/typhon/
- zoocoup.orghttps://www.zoocoup.org/casper/jamf_cheatsheet.pdf
- docs.jamf.comhttps://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
macos-jamf-cli-command-execution-for-account-mdm-and-framework-changes-be2e3a5c
title: "macOS: JAMF CLI (jamf) execution for account and MDM management"
id: c2f264d3-f927-44ef-a7eb-d3cf1cbc4a05
status: test
description: This rule identifies process executions where the macOS binary path ends with '/jamf' and the command line contains specific JAMF CLI subcommands. Attackers could abuse the JAMF tool to create or modify user accounts and manage or remove MDM-related components, potentially bypassing security controls. Detection relies on macOS process creation telemetry, including the executable path and command-line arguments.
references:
- https://github.com/MythicAgents/typhon/
- https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
- https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml
author: Jay Pandit, Huntrule Team
date: 2023-08-22
tags:
- attack.execution
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith: /jamf
CommandLine|contains:
- createAccount
- manage
- removeFramework
- removeMdmProfile
- resetPassword
- setComputerName
condition: selection
falsepositives:
- Legitimate use of the JAMF CLI tool by IT support and administrators
level: low
license: DRL-1.1
related:
- id: be2e3a5c-9cc7-4d02-842a-68e9cb26ec49
type: derived