File hidden via Chflags

[rule]
description = """
Detects when the Chflags utility is used with the hidden option in order to hide a file on the filesystem. Threat actors
will use this in order to hide their payloads in order to prevent them from being noticed.
"""
id = "56982407-82a2-4423-aa43-bdddb80eb9ad"
license = "Elastic License v2"
name = "File hidden via Chflags"
os_list = ["macos"]
reference = ["https://www.jamf.com/blog/jamf-threat-labs-observes-targeted-attacks-amid-fbi-warnings/"]
version = "1.0.8"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "chflags" and 
 process.command_line like~ "* hidden *" and process.command_line like~ ("* /Users/*", "* /tmp/*") and
 not process.parent.executable like ("/usr/libexec/xpcproxy", "/usr/local/jamf/bin/jamf") and
 not (process.parent.code_signature.team_id == "738UU3Y57V" and process.parent.code_signature.trusted == true) and
 not process.Ext.effective_parent.executable like ("/Applications/Adobe After Effects */Adobe After Effects *.app/Contents/MacOS/After Effects",
                                                   "/Library/Application Support/JAMF/Jamf.app/Contents/MacOS/JamfDaemon.app/Contents/MacOS/JamfDaemon")
'''

min_endpoint_version = "8.11.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"
[[threat.technique.subtechnique]]
id = "T1564.001"
name = "Hidden Files and Directories"
reference = "https://attack.mitre.org/techniques/T1564/001/"



[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "8.11.0"