Suspicious Disk Image Creation Through Hdiutil - MacOS (via process_creation)

title: Suspicious Disk Image Creation Through Hdiutil - MacOS (via process_creation)
id: 738eef13-a29f-5279-8107-5d07f54363d7
status: stable
description: This rule detects the execution of the hdiutil utility to create a disk image.
references:
    - https://www.loobins.io/binaries/hdiutil/
    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
    - https://ss64.com/mac/hdiutil.html
author: Huntrule Team
date: 2026-02-26
tags:
    - attack.exfiltration
    - attack.collection
    - attack.t1560
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: /hdiutil
        CommandLine|contains: 'create'
    condition: selection
falsepositives:
    - Unknown
level: medium