CatalogLOOBins

ORCHARD · Tool

tmutil

5 techniquesmacOSLOOBinsGPL-3.0

Disable Time Machine

macOS

The following command disables Time Machine. An attacker can use this to prevent backups from occurring.

tmutil disable
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Impact

Delete a backup

macOS

The following command deletes the specified backup. An adversary may perform this action before launching a ransomware attack to prevent the victim from restoring their files.

tmutil delete /path/to/backup
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Impact

Restore a backup

CollectionmacOS

The following command restore the specified backup. An attacker can use this to restore a backup of a sensitive file that was deleted.

tmutil restore /path/to/backup
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Collection

Tamper with system logs

Privilege EscalationmacOS

An adversary can use the snapshot and restore commands together to tamper with system logs. This is fixed in macOS 10.15.4+.

mkdir /tmp/snapshot
tmutil localsnapshot
tmutil listlocalsnapshots /
mount_apfs -o noowners -s com.apple.TimeMachine.2023-05-01-090000.local /System/Volumes/Data /tmp/snapshot
open /tmp/snapshot
sudo vim /var/log/system.log
tmutil restore com.apple.TimeMachine.2023-05-01-090000.local
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Privilege Escalation

Exclude path from backup

Defense EvasionmacOS

An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.

tmutil addexclusion /path/to/exclude
Evidence
Upstream reference
Environment
Local host
Compatibility
Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native
Defense Evasion