New File Exclusion Added To Time Machine Via Tmutil - MacOS

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•21

Detects the addition of a new file or path exclusion to macOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up, hindering recovery efforts.