New File Exclusion Added To Time Machine Via Tmutil - MacOS

Title: New File Exclusion Added To Time Machine Via Tmutil - MacOS
Status: test
Description:Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1490/T1490.md#atomic-test-12---disable-time-machine
  -https://www.loobins.io/binaries/tmutil/
Author: Pratinav Chandra
Date: 2024-05-29
modified:None
Tags:

• -'attack.impact'
• -'attack.t1490'

Logsource:

• category: process_creation
• product: macos

Detection:
  selection_img:
Image|endswith:'/tmutil' CommandLine|contains:'tmutil'   selection_cmd:
    CommandLine|contains: 'addexclusion'
  condition:all of selection_*
Falsepositives:
  -Legitimate administrator activity
Level: medium