Disk Image Creation Via Hdiutil - MacOS

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•19

Detects the execution of the hdiutil utility with the 'create' argument, indicating the creation of a disk image on macOS. This activity can be associated with data staging or exfiltration techniques.