CmdID

CmdID / Commands

hdiutil

Utility to create and manage disk images. tldr-pages

On macOS 2 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Mount an image

hdiutil attach path/to/image_fileIdentify

Trips 1 Sigma rule: mediumDisk Image Mounting Via Hdiutil - MacOS by Omar Khaled (@beacon_exe)

Unmount an image

hdiutil detach /Volumes/volume_fileIdentify

List mounted images

hdiutil infoIdentify

Create an ISO image from the contents of a directory

hdiutil makehybrid -o path/to/output_file path/to/directoryIdentify

What detects it

Sigma process creation rules that name hdiutil
mediumDisk Image Creation Via Hdiutil - MacOSOmar Khaled (@beacon_exe)
mediumDisk Image Mounting Via Hdiutil - MacOSOmar Khaled (@beacon_exe)