Disk Image Mounting Via Hdiutil on macOS

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•0•21

Detects the execution of the `hdiutil` utility on macOS to mount disk images. This activity can be associated with malware delivery, as adversaries often use disk images (.dmg files) to distribute malicious payloads. Monitoring this utility can help identify suspicious attempts to introduce or execute malware on a system.