diskutil

diskutil is the macOS command-line front end for local disk management. It lists physical and virtual disks, reports partition maps and APFS container layouts, mounts and unmounts volumes, manages APFS cryptographic users and FileVault state, lists and deletes APFS snapshots, and erases volumes, containers and whole disks. Its read-only verbs run without privileges and describe the entire storage topology of a host, including attached external and backup media and which volumes are encrypted. Its write verbs require ownership of the target disk, which in practice means root, and are irreversible - the man page itself warns that most of them present no confirmation prompt. That combination makes diskutil useful to an attacker at both ends of an intrusion - for storage reconnaissance early on, and for anti-forensics, recovery inhibition and destruction at the end. The utility also exposes mount options directly via -mountOptions, which diskarbitrationd passes verbatim to the filesystem mount program; this was the basis of CVE-2023-42931. Existing detection coverage for noowners mounts, such as Elastic's TCC-bypass rule and Jamf Protect's AUE_MOUNT telemetry correlation, matches on mount_apfs, the helper diskarbitrationd invokes to perform the mount - not on diskutil itself, since diskutil only requests the mount and exits. A rule written against mount_apfs will not fire on the diskutil invocation that triggered it, so detecting this technique from diskutil activity requires new coverage keyed on diskutil's own command-line arguments rather than the downstream mount_apfs process.