Sapphire Sleet - Malicious DMG Image Mounting (T1204.002)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•5

Detects a user mounting a deceptive .dmg file (e.g., posing as a crypto wallet or developer tool) resulting in the immediate execution of a hidden binary. The rule specifically looks for 'hdiutil attach' followed by a process execution from within a mounted volume that matches a common application or shell script path.