huntrule

Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Flags attrib.exe usage with +s to mark .exe/.dll and script files in public/temp/user-writable locations as system files.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies executions of attrib.exe with the +s option when the command line targets files in commonly abused user and application locations. Setting the system attribute can help attackers conceal malicious scripts or executables and interfere with casual deletion. The detection relies on Windows process creation telemetry, matching attrib.exe by image/original filename, and narrowing targets using command-line path substrings and specific file extensions.

Reporting behind it

Related detections9 linkedT1564.001 — drag to rearrange
Suspicious Executable Written to User Documents Subfolder (via file_event)
Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)
FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)
Suspicious Attrib Hiding of Stealer Artifacts (via process_creation)
Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)
Suspicious Executable Running From Fake Chrome User Profile Directory
Malicious Cryptominer Staging Files Dropped in tmp Directory
Suspicious Batch Script Unhiding Files via Attrib From Temp
Suspicious Hidden Directory configrc for Bandwidth SDK Abuse
Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions
Pivot detection · T1564.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.