macos community v1.0.0

chflags

Changes file or directory flags

📋 Live Preview 
chflags
chflags

Sandbox: execFile · Timeout: 30s

Capabilities

security.defenseevasion.bypass

Examples

Hide a file: Add the hidden flag to a file or directory to prevent it from being visible in Finder and Terminal.

chflags hidden ~/evil

Remove hidden flag: Remove the hidden flag to a file or directory to make it visible in Finder and Terminal.

chflags nohidden ~/evil

Detection

TypeRule / Indicator
sigma https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml Sigma: Hidden Flag Set On File/Directory Via Chflags

Documentation

The chflags utility modifies the file flags of the listed files as specified by the flags operand.

References