CmdID

CmdID / Commands

tmutil

Utility for managing Time Machine backups. tldr-pages

On macOS 3 Sigma rules name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Set an HFS+ drive as the backup destination

sudo tmutil setdestination path/to/disk_mount_pointIdentify

Set an APF share or SMB share as the backup destination

sudo tmutil setdestination "protocol://user:password@host/share"Identify

Append the given destination to the list of destinations

sudo tmutil setdestination -a destinationIdentify

Enable automatic backups

sudo tmutil enableIdentify

Disable automatic backups

sudo tmutil disableIdentify

Trips 1 Sigma rule: mediumTime Machine Backup Disabled Via Tmutil - MacOS by Pratinav Chandra

Start a backup, if one is not running already, and release control of the shell

sudo tmutil startbackupIdentify

Start a backup and block until the backup is finished

sudo tmutil startbackup -bIdentify

Stop a backup

sudo tmutil stopbackupIdentify

What detects it

Sigma process creation rules that name tmutil
mediumNew File Exclusion Added To Time Machine Via Tmutil - MacOSPratinav Chandra
mediumTime Machine Backup Deletion Attempt Via Tmutil - MacOSPratinav Chandra
mediumTime Machine Backup Disabled Via Tmutil - MacOSPratinav Chandra