macOS Data Destruction Tools

title: macOS Data Destruction Tools
id: e1f2a3b4-c5d6-4e7f-8a9b-0c1d2e3f4a5b
status: experimental
description: 'Detects execution of data destruction tools (rm, shred, srm, dd) with
  aggressive

  or recursive options which may indicate data destruction for impact or anti-forensics.

  Adversaries use these tools to destroy data, render systems inoperable, or cover
  tracks.

  '
author: Eric Brown - Nebulock, Inc.
date: 2025/10/31
modified: 2025/10/31
references:
- https://attack.mitre.org/techniques/T1485/
- https://attack.mitre.org/techniques/T1070/004/
logsource:
  product: macos
  service: endpointsecurity
detection:
  selection_event:
    esf.event_type: 9
    event.action: exec
  selection_process:
    Image|endswith:
    - /rm
    - /shred
    - /srm
    - /dd
  selection_dangerous:
    CommandLine|contains:
    - -rf
    - -R
    - --recursive
    - if=/dev/zero
    - if=/dev/random
    - of=/dev/
  condition: selection_event and selection_process and selection_dangerous
falsepositives:
- System maintenance and cleanup operations
- Software uninstallation procedures
- Legitimate disk management tasks
- Development and testing workflows
fields:
- Image
- CommandLine
- ProcessId
- ParentProcessId
- User
tags:
- attack.impact
- attack.t1485
- attack.t1070.004
level: high