macOS chflags Hidden Flag Set via chflags hidden parameter

Alerts when chflags is run with the hidden flag on macOS to make files or directories less visible.

FreeReviewedSigma · Medium · v2

Product: macos
Category: process_creation
Author: Omar Khaled (@beacon_exe) (SigmaHQ), DRL 1.1
Published: 2024-08-21
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion → C2

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1218System Binary Proxy Execution
- T1564.004NTFS File Attributes
Cred Access
- T1552.001Credentials In Files
Discovery
Lateral Movement
Collection
C2
- T1105Ingress Tool Transfer
Exfiltration
Impact

What it detects

This rule flags process executions of the chflags utility where the command line contains the hidden flag argument. Setting the hidden file system flag can make files or directories less visible in standard listings and file browsers, supporting attacker stealth. It relies on macOS process creation telemetry including the process image path/name and the command line.

Reporting behind it

Related detections9 linkedT1105 — drag to rearrange

Windows findstr.exe Subfolder and Case-Insensitive Search Flags

Suspicious File Download via certutil urlcache

Windows File Events: Legitimate Applications Writing Executables to Uncommon Locations

Windows Process Access: Suspicious WebDAV target execution via iediagcmd.exe or CustomShellHost.exe (CVE-2025-33053)

Windows Process Creation: Possible CVE-2025-33053 WebDAV RCE via utility search-order manipulation

Windows Scheduled Task Creation via schtasks.exe with curl and PowerShell Command Line Indicators

Windows Process Execution: Suspicious cmd.exe Command-Line Combinations (Pikabot-like)

Windows: Detect Ldifde.exe LDAP import (-i -f) usage

Windows: PrintBrm.exe ZIP extraction or creation via command-line parameters

macOS chflags Hidden Flag Set via chflags hidden parameter

Pivot detection · T1105 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

macos-process-execution-of-chflags-to-set-hidden-file-flags-3b2c1059

title: macOS chflags Hidden Flag Set via chflags hidden parameter
id: 58cca037-7cdf-49c7-ad85-3d1cbde17964
status: test
description: This rule flags process executions of the chflags utility where the command line contains the hidden flag argument. Setting the hidden file system flag can make files or directories less visible in standard listings and file browsers, supporting attacker stealth. It relies on macOS process creation telemetry including the process image path/name and the command line.
references:
  - https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
  - https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  - https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
  - https://ss64.com/mac/chflags.html
  - https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml
author: Omar Khaled (@beacon_exe), Huntrule Team
date: 2024-08-21
tags:
  - attack.credential-access
  - attack.command-and-control
  - attack.stealth
  - attack.t1218
  - attack.t1564.004
  - attack.t1552.001
  - attack.t1105
logsource:
  product: macos
  category: process_creation
detection:
  selection:
    Image|endswith: /chflags
    CommandLine|contains: "hidden "
  condition: selection
falsepositives:
  - Legitimate usage of chflags by administrators and users.
level: medium
license: DRL-1.1
related:
  - id: 3b2c1059-ae5f-40b6-b5d4-6106d3ac20fe
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL