Windows: attrib.exe +s Used to Mark Executables/Scripts in Common Drop Locations as System Files

title: "Windows: attrib.exe +s Used to Mark Executables/Scripts in Common Drop Locations as System Files"
id: c8cd4f3b-6a52-4f59-a495-255cb5be934f
related:
  - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b
    type: derived
  - id: efec536f-72e8-4656-8960-5e85d091345b
    type: derived
status: test
description: This rule flags Windows process executions of attrib.exe where the command line includes the +s option. It specifically looks for +s being applied to files in commonly abused user-writable or temporary directories and limits matches to script/executable file extensions such as .exe, .dll, .bat, .ps1, and .hta. Making files appear as system files can help adversaries reduce user visibility and hinder deletion with basic permissions. The detection relies on process creation telemetry, including Image/OriginalFileName and CommandLine content, plus path and extension indicators.
references:
  - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4
  - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-14
tags:
  - attack.stealth
  - attack.t1564.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \attrib.exe
    - OriginalFileName: ATTRIB.EXE
  selection_cli:
    CommandLine|contains: " +s"
  selection_paths:
    CommandLine|contains:
      - " %"
      - \Users\Public\
      - \AppData\Local\
      - \ProgramData\
      - \Downloads\
      - \Windows\Temp\
  selection_ext:
    CommandLine|contains:
      - .bat
      - .dll
      - .exe
      - .hta
      - .ps1
      - .vbe
      - .vbs
  filter_optional_installer:
    CommandLine|contains|all:
      - \Windows\TEMP\
      - .exe
  condition: all of selection* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1