Set Files as System Files Using Attrib.EXE
Detects the execution of the `attrib.exe` utility with the `+s` flag, which is used to mark files as system files. This technique can be used by adversaries to hide malicious files from users and some security tools, contributing to defense evasion.
Sigma
