Mustang Panda SHARDLOADER/ZOHOMURK Hidden File Attribute Set via attrib.exe

Ibrahim Saud@tektrix

•updated Jun 30, 2026•0•0•1

Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.