macOS: Process execution of chflags to set hidden file flags

title: "macOS: Process execution of chflags to set hidden file flags"
id: 58cca037-7cdf-49c7-ad85-3d1cbde17964
status: test
description: This rule flags process executions of the chflags utility where the command line contains the hidden flag setting. Setting the hidden attribute can reduce user visibility of files and directories, supporting stealth during post-compromise activity. It relies on macOS process creation telemetry, matching an image path that ends with /chflags and a command line substring indicating the hidden flag.
references:
  - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
  - https://ss64.com/mac/chflags.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-21
tags:
  - attack.credential-access
  - attack.command-and-control
  - attack.stealth
  - attack.t1218
  - attack.t1564.004
  - attack.t1552.001
  - attack.t1105
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /chflags
    CommandLine|contains: "hidden "
  condition: selection
falsepositives:
  - Legitimate usage of chflags by administrators and users.
level: medium
license: DRL-1.1
related:
  - id: 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
    type: derived