A bash or zsh oneliner can allow an attacker to set the file attribute to invisible. This action can establish persistence and evade detection for malicious files on the system.
for FILE in ~/*; do echo $(SetFile -a V $FILE && echo $(GetFileInfo $FILE)) >> /tmp/fileinfo.txt; sleep 2; done copy
Evidence Upstream reference
Environment Local host
Compatibility Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native Persistence, Defense Evasion Detection No detections at time of publishing: No detections at time of publishing
Setfile can be used with the -d and -m arguments to alter a file's creation and modification date, respectively.
SetFile -d "04/25/2023 11:11:00" -m "04/25/2023 11:12:00" targetfile.txt copy
Evidence Upstream reference
Environment Local host
Compatibility Imported from LOOBins; availability and behaviour depend on macOS version, privacy permissions and installed components. Not lab tested here.
Native Defense Evasion Detection No detections at time of publishing: No detections at time of publishing