Detection rules › Sigma
macOS ESF Rename To Hidden Dotfile
Detect renaming a file to a hidden path (dotfile) which may indicate stealthy behavior.
Known false positives
- developer tools and dotfile managers
MITRE ATT&CK coverage
| Tactic | Techniques |
|---|---|
| Stealth |
Rule body
title: macOS ESF Rename To Hidden Dotfile
id: 8d7b7c6e-2f7a-4f8d-8f1b-5a3f0e1a2c44
status: experimental
description: Detect renaming a file to a hidden path (dotfile) which may indicate
stealthy behavior.
author: Eric Brown - Nebulock, Inc.
date: 2025-10-29
logsource:
product: macos
service: endpointsecurity
level: medium
detection:
selection_evt:
esf.event_type: 21
event.action: rename
selection_path:
DestinationFilename|contains: '/.'
TargetFilename|contains: '/.'
condition: selection_evt and (selection_path)
falsepositives:
- developer tools and dotfile managers
modified: 2025/01/15
Stages and Predicates
Stage 0: condition
selection_evt and (selection_path)Stage 1: selection_evt
selection_evt:
esf.event_type: 21
event.action: rename
Stage 2: selection_path
selection_path:
DestinationFilename|contains: '/.'
TargetFilename|contains: '/.'
Indicators
These rows show field, operator, and value matches.