Hidden Flag Set On File/Directory Via Chflags - MacOS

SigmaHQ Detections@sigmaHQ

•updated Jul 1, 2025•1•0•22

Detects the execution of the "chflags" utility with the "hidden" flag on macOS. When this flag is set on a file or directory, it becomes invisible to default file listing commands and graphical file browsers, a common technique used by adversaries for defense evasion.