macOS tmutil Time Machine Backup Deletion Attempts
Flags tmutil executions with delete in the command line that attempt to remove Time Machine backups.
- Product
- macos
- Category
- process_creation
- Author
- Pratinav Chandra (SigmaHQ), DRL 1.1
- Published
- 2024-05-29
- Updated
- 2026-07-31
ATT&CK techniques
ImpactRecon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
What it detects
This rule flags process activity where tmutil is invoked with command-line content indicating a delete operation, targeting macOS Time Machine backups. Deleting backups can prevent recovery and supports impact-focused activity by reducing available restore points. The detection relies on process creation telemetry, matching the tmutil binary name/path and command-line substrings for tmutil invocation and deletion intent.
Reporting behind it
- github.comhttps://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- loobins.iohttps://www.loobins.io/binaries/tmutil/
- github.comhttps://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml
Changelog
v2- v2Candidate ingested via manual entry.2026-07-31
- v1No changelog recorded for this version.2026-07-30
Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.
title: macOS tmutil Time Machine Backup Deletion Attempts
id: 25407683-f21e-493c-88f4-e4e78c62a304
status: test
description: This rule flags process activity where tmutil is invoked with command-line content indicating a delete operation, targeting macOS Time Machine backups. Deleting backups can prevent recovery and supports impact-focused activity by reducing available restore points. The detection relies on process creation telemetry, matching the tmutil binary name/path and command-line substrings for tmutil invocation and deletion intent.
references:
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
- https://www.loobins.io/binaries/tmutil/
- https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml
author: Pratinav Chandra, Huntrule Team
date: 2024-05-29
tags:
- attack.impact
- attack.t1490
logsource:
category: process_creation
product: macos
detection:
selection_img:
- Image|endswith: /tmutil
- CommandLine|contains: tmutil
selection_cmd:
CommandLine|contains: delete
condition: all of selection_*
falsepositives:
- Legitimate activities
level: medium
license: DRL-1.1
related:
- id: 452df256-da78-427a-866f-49fa04417d74
type: derived