Windows: attrib.exe Run with +s Flag to Mark Files as System Files

title: "Windows: attrib.exe Run with +s Flag to Mark Files as System Files"
id: dba3aaf0-cdd4-41d6-8469-5caa78a7483e
related:
  - id: efec536f-72e8-4656-8960-5e85d091345b
    type: similar
  - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b
    type: derived
status: test
description: This rule identifies process executions of attrib.exe where the command line includes the +s flag, indicating files are being marked as system files. Attackers may use this behavior to increase stealth by disguising files or hiding activity-related artifacts from casual observation. It relies on Windows process creation telemetry, matching attrib.exe by image/original filename and the presence of the +s option in the command line.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-3---create-windows-system-file-with-attrib
  - https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
  - https://github.com/SigmaHQ/sigma/blob/master/rules-threat-hunting/windows/process_creation/proc_creation_win_attrib_system.yml
author: frack113, Huntrule Team
date: 2022-02-04
modified: 2023-03-14
tags:
  - attack.stealth
  - attack.t1564.001
  - detection.threat-hunting
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \attrib.exe
    - OriginalFileName: ATTRIB.EXE
  selection_cli:
    CommandLine|contains: " +s "
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1