New File Exclusion Added To Time Machine Via Tmutil - MacOS

SigmaHQ Detections@sigmaHQ

•updated Apr 16, 2025•0•0•0

Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.