Suspicious Disk Image Mounting Through Hdiutil - MacOS (via process_creation)

title: Suspicious Disk Image Mounting Through Hdiutil - MacOS (via process_creation)
id: c4aa2d2b-94ba-5f4c-8864-0321eab12771
status: stable
description: This rule detects the execution of the hdiutil utility to mount disk images.
references:
    - https://attack.mitre.org/techniques/T1560/001/
    - https://attack.mitre.org/techniques/T1566/001/
    - https://www.loobins.io/binaries/hdiutil/
    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
    - https://ss64.com/mac/hdiutil.html
author: Huntrule Team
date: 2026-01-06
tags:
    - attack.initial-access
    - attack.collection
    - attack.t1566.001
    - attack.t1560.001
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: /hdiutil
        CommandLine|contains:
            - 'attach '
            - 'mount '
    condition: selection
falsepositives:
    - Unknown
level: medium