XWorm - Stealth Attribute Modification (T1222.001)

Ibrahim Saud@tektrix

•updated Jun 21, 2026•0•0•6

Detects the use of 'attrib.exe' to modify file attributes to hidden and system for a file named 'Win.Kernel_Svc', which is indicative of the XWorm malware attempting to conceal its payload.