Set Suspicious Files as System Files Using Attrib.EXE
Detects the usage of `attrib.exe` with the `+s` option to set scripts or executables located in suspicious directories as system files. This technique is used to hide files from users and prevent them from being easily deleted. The rule specifically targets common suspicious locations and file extensions to reduce false positives.
Sigma
