Hidden Flag Set On File/Directory Via Chflags - MacOS

Title: Hidden Flag Set On File/Directory Via Chflags - MacOS
Status: test
Description:Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
References:
  -https://www.sentinelone.com/labs/apt32-multi-stage-macos-trojan-innovates-on-crimeware-scripting-technique/
  -https://www.welivesecurity.com/2019/04/09/oceanlotus-macos-malware-update/
  -https://www.paloaltonetworks.com/content/dam/pan/en_US/assets/pdf/reports/Unit_42/unit42-wirelurker.pdf
  -https://ss64.com/mac/chflags.html
Author: Omar Khaled (@beacon_exe)
Date: 2024-08-21
modified:None
Tags:

• -'attack.credential-access'
• -'attack.command-and-control'
• -'attack.stealth'
• -'attack.t1218'
• -'attack.t1564.004'
• -'attack.t1552.001'
• -'attack.t1105'

Logsource:

• product: macos
• category: process_creation

Detection:
  selection:
    Image|endswith: '/chflags'
    CommandLine|contains: 'hidden '
  condition:selection
Falsepositives:
  -Legitimate usage of chflags by administrators and users.
Level: medium