macOS tmutil Time Machine Backup Deletion Command Attempt

title: macOS tmutil Time Machine Backup Deletion Command Attempt
id: 25407683-f21e-493c-88f4-e4e78c62a304
status: test
description: This rule identifies process execution events where the tmutil binary is invoked to delete, specifically matching command lines that contain both tmutil and the keyword delete. Deleting Time Machine backups can remove restore options and may be used to hinder recovery after a disruptive activity. The detection relies on process creation telemetry, including the process image path and the command line arguments.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  - https://www.loobins.io/binaries/tmutil/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
  - attack.impact
  - attack.t1490
logsource:
  category: process_creation
  product: macos
detection:
  selection_img:
    - Image|endswith: /tmutil
    - CommandLine|contains: tmutil
  selection_cmd:
    CommandLine|contains: delete
  condition: all of selection_*
falsepositives:
  - Legitimate activities
level: medium
license: DRL-1.1
related:
  - id: 452df256-da78-427a-866f-49fa04417d74
    type: derived