Mustang Panda Hidden Attribute Set on DLL in ProgramData/AppData (T1564.001)

Ibrahim Saud@tektrix

•updated Jun 30, 2026•2•0•4

Detects the use of 'attrib.exe' to modify file attributes (specifically adding hidden or system attributes) on files with a '.dll' extension located in suspicious directories such as 'ProgramData', 'AppData', or other paths frequently used for persistence or file staging. This behavior is indicative of an adversary attempting to hide malicious artifacts.