T1564.001 Hidden Files and Directories via attrib, PowerShell, icacls, Dot-Files

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•8

Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.