Sigma rule: JAMF MDM Execution

Rule

Title

JAMF MDM Execution

Status

test

Level

low

Author

Jay Pandit

Date

2023-08-22

File

rules/macos/process_creation/proc_creation_macos_jamf_usage.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects execution of the "jamf" binary to create user accounts and run commands. For example, the binary can be abused by attackers on the system in order to bypass security controls or remove application control polices.

Log source

product

macos

category

process_creation

Detection

selection:
    Image|endswith: '/jamf'
    CommandLine|contains:
        # Note: add or remove commands according to your policy
        - 'createAccount'
        - 'manage'
        - 'removeFramework'
        - 'removeMdmProfile'
        - 'resetPassword'
        - 'setComputerName'
condition: selection

False positives (as the rule lists them)

• Legitimate use of the JAMF CLI tool by IT support and administrators

Tags

• attack.execution

References

• https://github.com/MythicAgents/typhon/
• https://www.zoocoup.org/casper/jamf_cheatsheet.pdf
• https://docs.jamf.com/10.30.0/jamf-pro/administrator-guide/Components_Installed_on_Managed_Computers.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_jamf_usage.yml