Time Machine Backup Disabled Via Tmutil - MacOS

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•0•1

Detects disabling of Time Machine (Apple's automated backup utility software) via the native macOS backup utility "tmutil". An attacker can use this to prevent backups from occurring.