Hidden File Attribute Set via attrib.exe +h Targeting AppData (T1564.001)
Detects the use of the Windows attrib.exe command with the +h (hidden) attribute flag applied to files within the AppData\Roaming or AppData\Local directories. This behavior is commonly associated with malware attempting to hide malicious components for persistence or evasion.
YARA-L
