ORCHARD · Tool

chflags

2 techniquesmacOSLOOBinsGPL-3.0

Hide a file

Defense EvasionmacOS

Add the hidden flag to a file or directory to prevent it from being visible in Finder and Terminal.

chflags hidden ~/evil

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion
Detection: Sigma: Hidden Flag Set On File/Directory Via Chflags: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/chflags.yml
ss64.com/mac/chflags.html
macosbin.com/bin/chflags
eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/

Defense EvasionmacOS

Remove the hidden flag to a file or directory to make it visible in Finder and Terminal.

chflags nohidden ~/evil

Evidence: Upstream reference
Environment: Local host
Compatibility: Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native: Defense Evasion
Detection: Sigma: Hidden Flag Set On File/Directory Via Chflags: github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml
Refs: github.com/infosecB/LOOBins/blob/399e3c4bdddb55c7dc49beb20bfe43490eac1184/LOOBins/chflags.yml
ss64.com/mac/chflags.html
macosbin.com/bin/chflags
eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/