Hidden File Attribute Assignment via Attrib

Tim Peck@timpeck

•updated Dec 23, 2025•3•0•128

Detects the use of attrib.exe to set system (+s) and hidden (+h) attributes on an executable file in a suspicious folder. This technique was observed being used by threat actors to hide payloads like SparkRAT.