Hidden Flag Set On File/Directory Via Chflags - MacOS
A Sigma rule for process creation on macOS, by Omar Khaled (@beacon_exe).
medium 4 ATT&CK techniques 1 program it names 2 everyday examples trip it
What it looks for
detection:
selection:
CommandLine|contains: 'hidden '
Image|endswith: '/chflags'
condition: selection
The rule’s detection, its selections and fields in order of name. The whole rule, with its references and false positives, is on SigmaHQ, by Omar Khaled (@beacon_exe), under the Detection Rule License 1.1. CmdID evaluates it on a command line alone: a test on what a command line cannot show, such as the parent process or the user, is not met.