Manipulate disk images using the DiskImages framework.
hdiutilhdiutilSandbox: execFile · Timeout: 30s
security.execution.command collection.data Mount a malicious dmg file: Uses hdiutil to mount a malicious dmg file to the system.
hdiutil mount malicious.dmgMount a malicious dmg file: Uses hdiutil to mount a malicious dmg file to the system.
hdiutil attach malicious.dmgMount a malicious iso file: Uses hdiutil to mount a malicious iso file to the system.
hdiutil mount malicious.isoMount a malicious iso file: Uses hdiutil to mount a malicious iso file to the system.
hdiutil attach malicious.isoExfiltrate data in dmg file: Uses hdiutil to create a dmg file to store exfiltrate data
hdiutil create -volname "Volume Name" -srcfolder /path/to/folder -ov diskimage.dmgExfiltrate data in encrypted dmg file: Uses hdiutil to create a dmg file to store exfiltrate data
hdiutil create -encryption -stdinpass -volname "Volume Name" -srcfolder /path/to/folder -ov encrypteddiskimage.dmg| Type | Rule / Indicator |
|---|---|
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml Sigma: Disk Image Mounting Via Hdiutil |
| sigma | https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml Sigma: Disk Image Creation Via Hdiutil |
hdiutil manipulates disk images such as DMG and ISO files. You can mount, unmount, create, resize and verify disk images. Including encrypted images.