Detectionmediumtest

Hidden Flag Set On File/Directory Via Chflags - MacOS

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Convert In Phoenix Studio

Open this Sigma rule in the converter with the YAML preloaded and ready for backend selection.

Launch

Omar KhaledCreated Wed Aug 213b2c1059-ae5f-40b6-b5d4-6106d3ac20femacos

Log Source

macOSProcess Creation

ProductmacOS← raw: macos

CategoryProcess Creation← raw: process_creation

Events generated when a new process is spawned on the system. Covers command-line arguments, parent/child relationships, and process metadata.

Detection Logic

detection:
    selection:
        Image|endswith: '/chflags'
        CommandLine|contains: 'hidden '
    condition: selection

False Positives

Legitimate usage of chflags by administrators and users.

References

MITRE ATT&CK

Tactics

TA0005 · Defense Evasion TA0006 · Credential Access TA0011 · Command and Control

Techniques

T1218 · System Binary Proxy Execution T1105 · Ingress Tool Transfer

Sub-techniques

T1564.004 · NTFS File Attributes T1552.001 · Credentials In Files

Rule Metadata

Rule ID

3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe

Status

test

Level

medium

Type

Detection

Created

Wed Aug 21

Author

Omar Khaled

Path

rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml

Raw Tags

attack.defense-evasionattack.credential-accessattack.command-and-controlattack.t1218attack.t1564.004attack.t1552.001attack.t1105

View on GitHub