Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Flags attrib.exe usage with +s to mark .exe/.dll and script files in public/temp/user-writable locations as system files.

FreeReviewedSigma · High · v2

Product: windows
Category: process_creation
Author: Nasreddine Bencherchali (Nextron Systems) (SigmaHQ), DRL 1.1
Published: 2022-06-28
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564.001Hidden Files and Directories
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies executions of attrib.exe with the +s option when the command line targets files in commonly abused user and application locations. Setting the system attribute can help attackers conceal malicious scripts or executables and interfere with casual deletion. The detection relies on Windows process creation telemetry, matching attrib.exe by image/original filename, and narrowing targets using command-line path substrings and specific file extensions.

Reporting behind it

Related detections9 linkedT1564.001 — drag to rearrange

Suspicious Executable Written to User Documents Subfolder (via file_event)

Suspicious Sobolan Staging Directory Creation in var tmp (via file_event)

FireWood Backdoor Persistence Files in Hidden kde-root Directory (via file_event)

Suspicious Attrib Hiding of Stealer Artifacts (via process_creation)

Suspicious perfctl Hidden IPC Directory Creation in tmp (via file_event)

Suspicious Executable Running From Fake Chrome User Profile Directory

Malicious Cryptominer Staging Files Dropped in tmp Directory

Suspicious Batch Script Unhiding Files via Attrib From Temp

Suspicious Hidden Directory configrc for Bandwidth SDK Abuse

Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions

Pivot detection · T1564.001 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

windows-attrib-exe-s-used-to-mark-executables-scripts-in-common-drop-locations-a-efec536f

title: Windows attrib.exe sets hidden system file attribute (+s) on suspicious paths and script/executable extensions
id: c8cd4f3b-6a52-4f59-a495-255cb5be934f
related:
  - id: bb19e94c-59ae-4c15-8c12-c563d23fe52b
    type: derived
  - id: efec536f-72e8-4656-8960-5e85d091345b
    type: derived
status: test
description: This rule identifies executions of attrib.exe with the +s option when the command line targets files in commonly abused user and application locations. Setting the system attribute can help attackers conceal malicious scripts or executables and interfere with casual deletion. The detection relies on Windows process creation telemetry, matching attrib.exe by image/original filename, and narrowing targets using command-line path substrings and specific file extensions.
references:
  - https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4
  - https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0
  - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
  - https://github.com/SigmaHQ/sigma/blob/master/rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml
author: Nasreddine Bencherchali (Nextron Systems), Huntrule Team
date: 2022-06-28
modified: 2023-03-14
tags:
  - attack.stealth
  - attack.t1564.001
logsource:
  category: process_creation
  product: windows
detection:
  selection_img:
    - Image|endswith: \attrib.exe
    - OriginalFileName: ATTRIB.EXE
  selection_cli:
    CommandLine|contains: " +s"
  selection_paths:
    CommandLine|contains:
      - " %"
      - \Users\Public\
      - \AppData\Local\
      - \ProgramData\
      - \Downloads\
      - \Windows\Temp\
  selection_ext:
    CommandLine|contains:
      - .bat
      - .dll
      - .exe
      - .hta
      - .ps1
      - .vbe
      - .vbs
  filter_optional_installer:
    CommandLine|contains|all:
      - \Windows\TEMP\
      - .exe
  condition: all of selection* and not 1 of filter_optional_*
falsepositives:
  - Unknown
level: high
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL