Rule Info
Name
Disk Image Mounting Via Hdiutil - MacOS
Author
Omar Khaled (@beacon_exe)
Description
Detects the execution of the hdiutil utility in order to mount disk images.
Reference
Date
2024-08-10 00:00:00
Modified
None
Id
bf241472-f014-4f01-a869-96f99330ca8c
Tags
attack.initial-access attack.t1566.001 attack.t1560.001 DEMO
Type
Community Rule
Link to Public Repo
Scan your endpoints, forensic images or collected files with our portable scanner THOR