# chflags

> Changes file or directory flags

The chflags utility modifies the file flags of the listed files as 
specified by the flags operand.

- Page: https://loobins.io/binaries/chflags/
- Author: demonduck
- Created: 2024-07-25
- Tactics: Defense Evasion

## Paths

- `/usr/bin/chflags`

## Example Use Cases

### Hide a file

Add the hidden flag to a file or directory to prevent it from being 
visible in Finder and Terminal.

```bash
chflags hidden ~/evil
```

- Tactics: Defense Evasion
- Tags: finder

### Remove hidden flag

Remove the hidden flag to a file or directory to make it visible in Finder
and Terminal.

```bash
chflags nohidden ~/evil
```

- Tactics: Defense Evasion
- Tags: finder

## Detections

- [Sigma: Hidden Flag Set On File/Directory Via Chflags](https://github.com/SigmaHQ/sigma/blob/master/rules/macos/process_creation/proc_creation_macos_chflags_hidden_flag.yml)

## Resources

- [chflags man page](https://ss64.com/mac/chflags.html)
- [macOS/binaries/chflags](https://macosbin.com/bin/chflags)
- [How to hide files and folders](https://eclecticlight.co/2024/07/03/how-to-hide-files-and-folders/)