Techniques
Sample rules
MacOS Hidden Files and Directories
- source: splunk
- technicques:
- T1564.001
Description
The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker’s attempt to conceal malicious activities or unauthorized data. Hidden files and directories are often used to evade detection by security tools and administrators, providing a stealthy means for storing malware, logs, or sensitive information. By monitoring for unusual or unauthorized creation of hidden files and directories, this analytic helps identify potential attempts to hide or unauthorized creation of hidden files and directories, and helps identify potential attempts to hide malicious operations, enabling security teams to uncover and address hidden threats effectively.
Detection logic
| tstats `security_content_summariesonly` count min(_time) as firstTime max(_time) as lastTime from datamodel=Endpoint.Processes where
(
Processes.process="*chflags *"
Processes.process="* hidden*"
)
OR
(
Processes.process="*xattr *"
Processes.process="* -wx *"
Processes.process="*com.apple.FinderInfo*"
)
by Processes.dest Processes.original_file_name Processes.parent_process_id
Processes.process Processes.process_exec Processes.process_guid
Processes.process_hash Processes.process_id
Processes.process_current_directory Processes.process_name
Processes.process_path Processes.user
Processes.user_id Processes.vendor_product
| `drop_dm_object_name(Processes)`
| `security_content_ctime(firstTime)`
| `security_content_ctime(lastTime)`
| `macos_hidden_files_and_directories_filter`