diskutil is a macOS command-line tool for managing disks, partitions, and volumes. Attackers may abuse it to enumerate storage, mount or modify volumes, and support data access or destructive actions using a trusted system utility. Defenders should monitor unusual administrative use, destructive operations, and disk changes outside approved maintenance.
What it does and why security teams care
diskutil is a built-in macOS command-line utility for disk, partition, and volume management. Because it is trusted and widely available on endpoints, it can be used for legitimate administration or for abuse when an attacker gains interactive access.
As a Living off the Land Guide explains, trusted system utilities can become a post-exploitation path when they are invoked outside normal maintenance windows or by unexpected users. That makes the tool less interesting as malware and more important as an abuseable control surface.
How disk and volume operations become risky
The security issue is not the utility itself, but the authority it carries. If an attacker can list disks, mount filesystems, alter partition layouts, or write to volumes, they may be able to locate sensitive data, expose offline content, or disrupt availability by changing storage state.
This is the same defensive problem seen across other dual-use admin tools: a benign utility can provide a quiet route to data discovery, persistence support, or destructive change without dropping a new binary. Monitoring should therefore focus on what the command is asked to do, not only that it was launched.
What normal use looks like
Legitimate diskutil activity usually comes from administrators, recovery workflows, software deployment, imaging, or troubleshooting. Those uses are often clustered around change windows and are accompanied by other maintenance signals such as management tooling, ticketed work, or local console activity.
Suspicious use tends to look different: repeated enumeration, unexpected mounts or unmounts, partition edits, or destructive disk actions on systems that should not be receiving storage changes. Context matters, because the same command can be routine on a build host and highly abnormal on a user workstation.
What defenders should watch for
Useful detection comes from correlating process execution with user context, parent process, timing, and follow-on storage changes. A single invocation may be harmless, but a sequence of enumeration followed by mount, erase, repartition, or file access often indicates a more deliberate workflow.
Strong logging should preserve command-line arguments and the resulting disk state so responders can distinguish administration from abuse. If a command is used to reach offline data, tamper with recovery partitions, or prepare destructive action, the storage change itself becomes part of the incident evidence.
Risk and Threat Considerations
diskutil is risky because it can convert a normal admin capability into a trusted pathway for discovery, data access, or destructive change. If an attacker already has local execution, they can use it to work with disks using a built-in utility that may blend into legitimate maintenance noise.
Failure mechanism: The attacker abuses a signed macOS storage tool to enumerate devices, mount volumes, or alter partitions, which can bypass simple application allowlists and make malicious activity look like routine administration.
Impact: The result can be unauthorized access to data, tampering with disk state, service disruption, or destructive loss of availability on endpoints and servers.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 sets the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1059 — Command and Scripting Interpreter | diskutil abuse is command-line execution through a trusted interpreter path |
| T1218 — System Binary Proxy Execution | The term describes abuse of a trusted signed system utility for malicious action | |
| Recommendation — Correlate diskutil execution with parent process, user context, and follow-on storage actions to spot abuse. Hunt for trusted utility abuse and alert when diskutil performs unexpected storage changes. | ||
| CIS Controls v8 | CIS-8 — Audit Log Management | Storage tool misuse is best detected through preserved command and system activity logs |
| CIS-16 — Application Software Security | Built-in tools still need abuse-resistant control of execution paths and administrative use | |
| Recommendation — Centralize and review command-line and endpoint logs that record diskutil arguments and resulting disk changes. Restrict and monitor administrative tool use so diskutil runs only in approved maintenance contexts. | ||
Practitioner Guidance
Why practitioners should care: Treat diskutil as an administrative capability that deserves monitoring and change control, not as an inherently benign utility. The most useful control is context, because the same command is normal during recovery and suspicious when it appears unexpectedly on a production endpoint.
What to watch for: Pay attention to unusual parents, odd hours, repeated disk enumeration, and any command sequence that moves from discovery to modification. When the command is used outside approved maintenance, the storage change itself should be reviewed as potential evidence of compromise or destructive intent.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org