huntrule

Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Flags attrib.exe usage with +s to mark .exe/.dll and script files in public/temp/user-writable locations as system files.

FreeReviewedSigma · High · v2
Product
windows
Category
process_creation
Author
Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published
2022-06-28
Updated
2026-07-31
AnalysisDetection

ATT&CK techniques

Defense Evasion

  1. Recon

  2. Resource Dev

  3. Initial Access

  4. Execution

  5. Persistence

  6. Priv Esc

  7. Defense Evasion

  8. Cred Access

  9. Discovery

  10. Lateral Movement

  11. Collection

  12. C2

  13. Exfiltration

  14. Impact

What it detects

This rule identifies executions of attrib.exe with the +s option when the command line targets files in commonly abused user and application locations. Setting the system attribute can help attackers conceal malicious scripts or executables and interfere with casual deletion. The detection relies on Windows process creation telemetry, matching attrib.exe by image/original filename, and narrowing targets using command-line path substrings and specific file extensions.

Reporting behind it

Related detections9 linkedT1564.001 — drag to rearrange
Suspicious File Hiding via attrib Hidden and System Attributes (via process_creation)
Suspicious File Hidden via attrib in Public Documents (via process_creation)
Suspicious Execution from Reserved Device Name Directory by Miner Campaign
Suspicious File Hiding via Attrib System and Hidden Attributes
Suspicious attrib Hidden and System Attribute Assignment
Suspicious File Hiding via attrib Plus H in Java RAT Persistence Setup
Suspicious Execution of Hidden Binary from Private Tmp via Process Creation
Suspicious Executable Written to User Documents Subfolder (via file_event)
Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)
Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions
Pivot detection · T1564.001 · 9 related

Changelog

v2
  1. v2
    Candidate ingested via manual entry.2026-07-31
  2. v1
    No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.