Time Machine Backup Disabled via Tmutil on macOS

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•25

Detects when the Time Machine backup utility is disabled on macOS using the `tmutil` command-line tool. This action can be performed by an attacker to prevent system backups, hindering recovery efforts after an attack.