{"id":"3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe","title":"Hidden Flag Set On File/Directory Via Chflags - MacOS","description":"Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\nWhen a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\n","author":"Omar Khaled (@beacon_exe)","status":"test","level":"medium","date":"2024-08-21","modified":"","tags":["attack.credential-access","attack.command-and-control","attack.stealth","attack.t1218","attack.t1564.004","attack.t1552.001","attack.t1105"],"technique_ids":["T1105","T1218","T1552.001","T1564.004"],"logsource":{"product":"macos","category":"process_creation"},"falsepositives":["Legitimate usage of chflags by administrators and users."],"references":["https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/","https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/","https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf","https://ss64.com/mac/chflags.html"],"source_path":"rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","source_sha256":"a58d484dbf20af7d953bdd8ae2f2413aa25764f918a2e554596610ea44d79916","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Hidden Flag Set On File/Directory Via Chflags - MacOS\nid: 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe\nstatus: test\ndescription: |\n    Detects the execution of the \"chflags\" utility with the \"hidden\" flag, in order to hide files on MacOS.\n    When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.\nreferences:\n    - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/\n    - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/\n    - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf\n    - https://ss64.com/mac/chflags.html\nauthor: Omar Khaled (@beacon_exe)\ndate: 2024-08-21\ntags:\n    - attack.credential-access\n    - attack.command-and-control\n    - attack.stealth\n    - attack.t1218\n    - attack.t1564.004\n    - attack.t1552.001\n    - attack.t1105\nlogsource:\n    product: macos\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/chflags'\n        CommandLine|contains: 'hidden '\n    condition: selection\nfalsepositives:\n    - Legitimate usage of chflags by administrators and users.\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1105","id":"T1105","name":"Ingress Tool Transfer","page":"techniques/enterprise/T1105/"},{"key":"enterprise/T1218","id":"T1218","name":"System Binary Proxy Execution","page":"techniques/enterprise/T1218/"},{"key":"enterprise/T1552.001","id":"T1552.001","name":"Credentials In Files","page":"techniques/enterprise/T1552.001/"},{"key":"enterprise/T1564.004","id":"T1564.004","name":"NTFS File Attributes","page":"techniques/enterprise/T1564.004/"}],"data_path":"data/detection-rules/3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe.json","kind":"sigma"}