Disk Image Mounting Via Hdiutil - MacOS

detection:
  selection:
    CommandLine|contains:
      - 'attach '
      - 'mount '
    Image|endswith: '/hdiutil'
  condition: selection

The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Omar Khaled (@beacon_exe), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.