Time Machine Backup Deletion Attempt Via Tmutil - MacOS — Detection Rule
Detects deletion attempts of MacOS Time Machine backups via the native backup utility "tmutil". An adversary may perform this action before launching a ransonware attack to prevent the victim from restoring their files.