Sigma rule: Hidden Flag Set On File/Directory Via Chflags - MacOS

Rule

Title

Hidden Flag Set On File/Directory Via Chflags - MacOS

Status

test

Level

medium

Author

Omar Khaled (@beacon_exe)

Date

2024-08-21

File

rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml

Commit

ccbb0369507f796db0b0ae6854c8a2be471b9d84

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Log source

product

macos

category

process_creation

Detection

selection:
    Image|endswith: '/chflags'
    CommandLine|contains: 'hidden '
condition: selection

False positives (as the rule lists them)

• Legitimate usage of chflags by administrators and users.

Tags

• attack.credential-access
• attack.command-and-control
• attack.stealth
• attack.t1218
• attack.t1564.004
• attack.t1552.001
• attack.t1105

MITRE ATT&CK ids this rule names

• T1105
• T1218
• T1552.001
• T1564.004

References

• https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
• https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
• https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
• https://ss64.com/mac/chflags.html

Read on 2026-11-03T00:58:21.399Z under licence sigma-drl-1.1@d5f4c36a from https://github.com/SigmaHQ/sigma/blob/ccbb0369507f796db0b0ae6854c8a2be471b9d84/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml