CmdID

CmdID / Commands

chflags

Change file or directory flags. tldr-pages

On macOS 1 Sigma rule name it

Opens CmdID with your command. It is read in your browser and sent nowhere.

macOS

from tldr-pages, CC BY 4.0

Set the hidden flag for a file

chflags hidden path/to/fileIdentify

Trips 1 Sigma rule: mediumHidden Flag Set On File/Directory Via Chflags - MacOS by Omar Khaled (@beacon_exe)

Unset the hidden flag for a file

chflags nohidden path/to/fileIdentify

Trips 1 Sigma rule: mediumHidden Flag Set On File/Directory Via Chflags - MacOS by Omar Khaled (@beacon_exe)

Recursively set the uchg flag for a directory

chflags -R uchg path/to/directoryIdentify

Recursively unset the uchg flag for a directory

chflags -R nouchg path/to/directoryIdentify

What detects it

Sigma process creation rules that name chflags
mediumHidden Flag Set On File/Directory Via Chflags - MacOSOmar Khaled (@beacon_exe)