← All Binaries

SetFile

Uses the CommandLine/Terminal to set file and or directory attributes. It can set attributes, creator, creation date, modification date, and file type for multiple files at a time.

Persistence Stealth
Path
/usr/bin/SetFile
Author
Chris Campbell (@texasbe2trill)
Created
2023-04-23

Example Use Cases 2

Set a file or directory attribute to invisible #

A bash or zsh oneliner can allow an attacker to set the file attribute to invisible. This action can establish persistence and evade detection for malicious files on the system.

for FILE in ~/*; do echo $(SetFile -a V $FILE && echo $(GetFileInfo $FILE)) >> /tmp/fileinfo.txt; sleep 2; done
Persistence Stealth T1564.001 bashzshoneliner

Change a file's creation and modification timestamps #

Setfile can be used with the -d and -m arguments to alter a file's creation and modification date, respectively.

SetFile -d "04/25/2023 11:11:00" -m "04/25/2023 11:12:00" targetfile.txt
Stealth T1070.006 bashzshoneliner

Detections

  • No detections at time of publishing

Resources