Merge PR #4949 from @omaramin17 - Add new rules related to Hdiutil usage

new: Disk Image Mounting Via Hdiutil - MacOS
new: Disk Image Creation Via Hdiutil - MacOS 

---------

Co-authored-by: nasbench <8741929+nasbench@users.noreply.github.com>

rules/macos/process_creation/proc_creation_macos_hdiutil_create.yml

@@ -0,0 +1,23 @@
+title: Disk Image Creation Via Hdiutil - MacOS
+id: 1cf98dc2-fcb0-47c9-8aea-654c9284d1ae
+status: experimental
+description: Detects the execution of the hdiutil utility in order to create a disk image.
+references:
+    - https://www.loobins.io/binaries/hdiutil/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
+author: Omar Khaled (@beacon_exe)
+date: 2024/08/10
+tags:
+    - attack.exfiltration
+logsource:
+    product: macos
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: /hdiutil
+        CommandLine|contains: 'create'
+    condition: selection
+falsepositives:
+    - Legitimate usage of hdiutil by administrators and users.
+level: medium

rules/macos/process_creation/proc_creation_macos_hdiutil_mount.yml

@@ -0,0 +1,27 @@
+title: Disk Image Mounting Via Hdiutil - MacOS
+id: bf241472-f014-4f01-a869-96f99330ca8c
+status: experimental
+description: Detects the execution of the hdiutil utility in order to mount disk images.
+references:
+    - https://www.loobins.io/binaries/hdiutil/
+    - https://www.sentinelone.com/blog/from-the-front-linesunsigned-macos-orat-malware-gambles-for-the-win/
+    - https://ss64.com/mac/hdiutil.html
+author: Omar Khaled (@beacon_exe)
+date: 2024/08/10
+tags:
+    - attack.initial_access
+    - attack.t1566.001
+    - attack.t1560.001
+logsource:
+    product: macos
+    category: process_creation
+detection:
+    selection:
+        Image|endswith: /hdiutil
+        CommandLine|contains:
+            - 'attach '
+            - 'mount '
+    condition: selection
+falsepositives:
+    - Legitimate usage of hdiutil by administrators and users.
+level: medium