Hiding Files or Folders in Uncommon Location Using Attrib.exe

Swachchhanda Shrawan Poudel (Nextron Systems)

Detects the suspicious usage of attrib.exe to hide files or folders in suspicious or uncommon location. Adversaries often drop their malicious files on suspicious locations like public folders, temporary directories, etc. To avoid being visible to the user, they may use attrib.exe to hide the files.

2025-03-04 00:00:00

None

2b60cd51-aae4-460e-a15c-e3e88d843d9e

attack.defense-evasion attack.t1564.001

Nextron Sigma feed only (private)