Time Machine Backup Disabled Via Tmutil - MacOS

Status: test
Severity: medium
Log source: category process_creation, product macos
Author: Pratinav Chandra
Source: github.com/SigmaHQ/sigma

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.

Known false positives

Legitimate administrator activity

MITRE ATT&CK coverage

Tactic	Techniques
Impact	`T1490` Inhibit System Recovery

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Time Machine Backup Disabled Via Tmutil - MacOS
id: 2c95fa8a-8b8d-4787-afce-7117ceb8e3da
status: test
description: |
    Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil".
    An attacker can use this to prevent backups from occurring.
references:
    - https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
    - https://www.loobins.io/binaries/tmutil/
author: Pratinav Chandra
date: 2024-05-29
tags:
    - attack.impact
    - attack.t1490
logsource:
    category: process_creation
    product: macos
detection:
    selection_img:
        - Image|endswith: '/tmutil'
        - CommandLine|contains: 'tmutil'
    selection_cmd:
        CommandLine|contains: 'disable'
    condition: all of selection_*
falsepositives:
    - Legitimate administrator activity
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '/tmutil'
    - CommandLine|contains: 'tmutil'

Stage 2: `selection_cmd`

selection_cmd:
    CommandLine|contains: 'disable'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`disable` `tmutil`	`field:"CommandLine" kind:match`
`Image`	ends_with	`/tmutil`	`field:"Image" kind:ends_with value:"/tmutil"`