Windows Hidden Attribute Set on Malicious File

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to set the hidden attribute on a file using the 'attrib +h' command over a network connection to a Windows machine (port 445). This technique is often used by attackers to hide malicious files from users and system administrators, contributing to defense evasion.