Hidden Flag Set On File/Directory Via Chflags - MacOS

Status: test
Severity: medium
Log source: category process_creation, product macos
Author: Omar Khaled (@beacon_exe)
Source: github.com/SigmaHQ/sigma

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

Known false positives

Legitimate usage of chflags by administrators and users.

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1218` System Binary Proxy Execution `T1564.004` Hide Artifacts: NTFS File Attributes
Credential Access	`T1552.001` Unsecured Credentials: Credentials In Files
Command & Control	`T1105` Ingress Tool Transfer

Telemetry coverage

Platform	Record / event type
macOS	ESF event `exec` (NOTIFY): Fires after execve(2) or posix_spawn(2) succeeds, delivering a post-fact record of the new process.

Rule body

title: Hidden Flag Set On File/Directory Via Chflags - MacOS
id: 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
status: test
description: |
    Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
    When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
references:
    - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
    - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
    - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
    - https://ss64.com/mac/chflags.html
author: Omar Khaled (@beacon_exe)
date: 2024-08-21
tags:
    - attack.credential-access
    - attack.command-and-control
    - attack.stealth
    - attack.t1218
    - attack.t1564.004
    - attack.t1552.001
    - attack.t1105
logsource:
    product: macos
    category: process_creation
detection:
    selection:
        Image|endswith: '/chflags'
        CommandLine|contains: 'hidden '
    condition: selection
falsepositives:
    - Legitimate usage of chflags by administrators and users.
level: medium

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    Image|endswith: '/chflags'
    CommandLine|contains: 'hidden '

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`hidden`	`field:"CommandLine" kind:match value:"hidden "`
`Image`	ends_with	`/chflags`	`field:"Image" kind:ends_with value:"/chflags"`