New File Exclusion Added To Time Machine Via Tmutil - MacOS — Detection Rule
Detects the addition of a new file or path exclusion to MacOS Time Machine via the "tmutil" utility. An adversary could exclude a path from Time Machine backups to prevent certain files from being backed up.