MarkiRAT attrib -h used to unhide dropped svehost.exe

Duo Tech@duotech

•updated Jul 7, 2026•7•1•21

Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.