Time Machine Backup Disabled Via Tmutil - MacOS

Title: Time Machine Backup Disabled Via Tmutil - MacOS
Status: test
Description:Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  -https://www.loobins.io/binaries/tmutil/
Author: Pratinav Chandra
Date: 2024-05-29
modified:None
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_img:
Image|endswith:'/tmutil' CommandLine|contains:'tmutil'   selection_cmd:
    CommandLine|contains: 'disable'
  condition:all of selection_*
Falsepositives:
  -Legitimate administrator activity
Level: medium