# hdiutil

> Manipulate disk images using the DiskImages framework.

hdiutil manipulates disk images such as DMG and ISO files. You can mount, unmount, create, resize and verify disk images. Including encrypted images.

- Page: https://loobins.io/binaries/hdiutil/
- Author: Mark Morowczynsk (@markmorow)
- Created: 2023-05-21
- Tactics: Execution, Collection

## Paths

- `/usr/bin/hdiutil`

## Example Use Cases

### Mount a malicious dmg file

Uses hdiutil to mount a malicious dmg file to the system.

```bash
hdiutil mount malicious.dmg
```

- Tactics: Execution
- Tags: bash, zsh, disk

### Mount a malicious dmg file

Uses hdiutil to mount a malicious dmg file to the system.

```bash
hdiutil attach malicious.dmg
```

- Tactics: Execution
- Tags: bash, zsh, disk

### Mount a malicious iso file

Uses hdiutil to mount a malicious iso file to the system.

```bash
hdiutil mount malicious.iso
```

- Tactics: Execution
- Tags: bash, zsh, disk

### Mount a malicious iso file

Uses hdiutil to mount a malicious iso file to the system.

```bash
hdiutil attach malicious.iso
```

- Tactics: Execution
- Tags: bash, zsh, disk

### Exfiltrate data in dmg file

Uses hdiutil to create a dmg file to store exfiltrate data

```bash
hdiutil create -volname "Volume Name" -srcfolder /path/to/folder -ov diskimage.dmg
```

- Tactics: Collection
- Tags: bash, zsh, disk

### Exfiltrate data in encrypted dmg file

Uses hdiutil to create a dmg file to store exfiltrate data

```bash
hdiutil create -encryption -stdinpass -volname "Volume Name" -srcfolder /path/to/folder -ov encrypteddiskimage.dmg
```

- Tactics: Collection
- Tags: bash, zsh, disk

## Detections

- [Sigma: Disk Image Mounting Via Hdiutil](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml)
- [Sigma: Disk Image Creation Via Hdiutil](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml)

## Resources

- [Microsoft finds new macOS vulnerability, Shrootless, that could bypass System Integrity Protection](https://www.microsoft.com/en-us/security/blog/2021/10/28/microsoft-finds-new-macos-vulnerability-shrootless-that-could-bypass-system-integrity-protection/)