Time Machine Backup Deletion Attempt Via Tmutil - MacOS

Title: Time Machine Backup Deletion Attempt Via Tmutil - MacOS
Status: test
Description:Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  -https://www.loobins.io/binaries/tmutil/
Author: Pratinav Chandra
Date: 2024-05-29
modified:None
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_img:
Image|endswith:'/tmutil' CommandLine|contains:'tmutil'   selection_cmd:
    CommandLine|contains: 'delete'
  condition:all of selection_*
Falsepositives:
  -Legitimate activities
Level: medium