diff --git a/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml b/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
new file mode 100644
index 00000000000..7e6ec47bf93
--- /dev/null
+++ b/rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml
@@ -0,0 +1,23 @@
+title: Disk Image Creation Via Hdiutil - MacOS
+id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae
+status: experimental
+description: Detects the execution of the hdiutil utility in order to create a disk image.
+references:
+    - https://www.loobins.io/binaries/hdiutil/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
+author: Omar Khaled (@beacon_exe)
+date: 2024/08/10
+tags:
+    - attack.exfiltration
+logsource:
+    product: macos
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: /hdiutil
+        CommandLine|contains: 'create'
+    condition: selection
+falsepositives:
+    - Legitimate usage of hdiutil by administrators and users.
+level: medium
diff --git a/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml b/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml
new file mode 100644
index 00000000000..ee3ae233f60
--- /dev/null
+++ b/rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml
@@ -0,0 +1,27 @@
+title: Disk Image Mounting Via Hdiutil - MacOS
+id: bf241472-f014-4f01-a869-96f99330ca8c
+status: experimental
+description: Detects the execution of the hdiutil utility in order to mount disk images.
+references:
+    - https://www.loobins.io/binaries/hdiutil/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
+author: Omar Khaled (@beacon_exe)
+date: 2024/08/10
+tags:
+    - attack.initial_access
+    - attack.t1566.001
+    - attack.t1560.001
+logsource:
+    product: macos
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: /hdiutil
+        CommandLine|contains:
+            - 'attach '
+            - 'mount '
+    condition: selection
+falsepositives:
+    - Legitimate usage of hdiutil by administrators and users.
+level: medium