Possible Execution of JAMF MDM (via process_creation)

title: Possible Execution of JAMF MDM (via process_creation)
id: 7567944a-eb62-560b-82bc-a4a5b95e8c7b
status: stable
description: This rule detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be misused by adversaries on the system to bypass security controls or remove application control polices.
references:
    - https://github.com/MythicAgents/typhon/
    - https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
    - https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html
author: Huntrule Team
date: 2026-06-08
tags:
    - attack.execution
    - attack.lateral-movement
    - attack.t1072
logsource:
    category: process_creation
    product: macos
detection:
    selection:
        Image|endswith: '/jamf'
        CommandLine|contains:
            - 'createAccount'
            - 'manage'
            - 'removeFramework'
            - 'removeMdmProfile'
            - 'resetPassword'
            - 'setComputerName'
    condition: selection
falsepositives:
    - Unknown
level: low