hdiutil is a macOS command-line tool for creating, mounting and managing disk images. Attackers abuse it to mount malicious images, stage payloads, or move code through trusted system functions. Defenders should watch for unusual image mounts, automated use from scripts, and execution from mounted volumes.
What hdiutil Does in macOS
hdiutil is a macOS utility for working with disk images, so its normal job is operational rather than malicious. The security significance comes from the fact that disk images can carry files, scripts, installers, and other content that becomes active once mounted.
Because it is a built-in system tool, defenders should treat its use as context-dependent: routine software installation and packaging can be legitimate, but the same command is also a common way to stage payloads, hide material from casual inspection, or leverage trusted system behaviour.
Why hdiutil Is Abused
Attackers abuse disk-image workflows because they create a trusted-looking delivery path. A mounted image can make a malicious file appear to come from a local, user-initiated source, which can reduce suspicion and help bypass simple controls that focus on downloads rather than mounts.
That matters most when the image is mounted and then immediately used as a launch point for execution. The risk is not the command alone, but the combination of mounting, placing code on the mounted volume, and using macOS trust in system utilities to make the activity blend in.
For a broader view of how dual-use utilities fit into attacker tradecraft, see the Living off the Land Guide, which covers LOLBins, application control, and detection patterns across trusted binaries.
How Organizations Detect Suspicious Use
Detection starts with correlating process creation, mount activity, and subsequent execution from newly mounted volumes. Unusual parent-child process relationships, scripted or repeated use of hdiutil, and image mounts that do not match user or IT workflow are all useful signals.
It also helps to compare current activity against a software and asset baseline. If a workstation that normally never mounts disk images suddenly begins doing so, or if the activity appears during an otherwise unrelated task, that pattern deserves scrutiny. Mount points, hashes of downloaded images, and the identity of the invoking process can all improve triage.
macOS defenders should also watch for post-mount execution from volumes that are not part of approved installers or managed deployment tooling. A mount event followed by archive expansion, shell activity, or app launch from the mounted path is often more important than the mount itself.
Practical Controls and Response
Control effectiveness improves when macOS hardening, application control, and monitoring work together. Restricting unexpected disk-image handling, alerting on unusual command-line use, and reviewing whether mounted content is allowed in the local environment all reduce abuse potential.
When suspicious use is found, the response should focus on the mounted image, the files it carried, and any code launched from it. That may include isolating the host, preserving the image file for analysis, checking for persistence, and reviewing whether the mount was a delivery step for additional malware.
If the behavior matches a known living-off-the-land pattern, defenders should map it to trusted-binary abuse rather than treating it as a simple file-download event. The Living off the Land Guide is useful for that kind of triage because it ties these mechanics to detection and hardening decisions.
Risk and Threat Considerations
hdiutil is risky because it can turn a normal macOS maintenance action into a delivery and execution path for malicious code. The key danger is trust abuse: a mounted disk image can look like an ordinary local artifact even when it was used to stage malware or disguise the source of execution.
Failure mechanism: An attacker delivers or prepares content inside a disk image, mounts it through a trusted system utility, and uses the mounted volume as a launch surface for payload execution or follow-on activity.
Impact: This can enable stealthier payload staging, weaken user suspicion, and increase the chance that malicious code runs under an apparently legitimate workflow.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST CSF 2.0 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1021 — Remote Services | hdiutil abuse fits trusted utility and execution-path tradecraft used in attacker staging. |
| Recommendation — Map suspicious disk-image activity to ATT&CK and hunt for trusted-utility abuse in your endpoint telemetry. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | Monitoring and restricting malicious disk-image payload staging supports malware defense outcomes. |
| Recommendation — Alert on disk-image mounts and block unapproved execution paths from mounted volumes. | ||
| NIST CSF 2.0 | DE.CM-01 — Monitoring for Unauthorized Personnel, Connections, Devices, and Software | Suspicious image mounts and unexpected execution from mounted volumes are monitoring events. |
| PR.DS-01 — Data-at-rest is protected | Disk images often contain staged files whose integrity and exposure matter during handling. | |
| Recommendation — Correlate mount events with execution telemetry and investigate deviations from normal software use. Protect downloaded and mounted disk-image content with integrity checks and controlled handling. | ||
Practitioner Guidance
What to watch for: Treat repeated or scripted hdiutil activity, especially from unusual processes or user contexts, as a signal to review the full mount-to-execution chain rather than the command in isolation. The important question is whether the image belongs to an approved workflow, not whether the binary is native to macOS.
Practitioner takeaway: hdiutil is best handled as a trusted utility with abuse potential, so the right control strategy is to monitor how it is used, not merely whether it is present.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 20, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org