• CommunityEnterprisePlans
  • Intel Exchange
    Intel ExchangeDetections
  • Resources
  • About
  • Leaderboard
Join CommunitySign In
    All Detections

    PSExec Attrib commands

    GlassDiceBearhttps://www.dicebear.comhttps://creativecommons.org/publicdomain/zero/1.0/„Glass” (https://www.dicebear.com) by „DiceBear”, licensed under „CC0 1.0” (https://creativecommons.org/publicdomain/zero/1.0/)
    Azure Sentinel@AzureSentinel
    •updated Jun 17, 2025•0•19

    Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.

    Microsoft Sentinel (KQL)

    Tags

    TA0007 - DiscoveryS0029 - PsExecT1083 - File and Directory DiscoveryS1176 - attribT1059 - Command and Scripting InterpreterT1059.003 - Windows Command ShellTA0002 - ExecutionProcess CreationCommand ExecutionFile AccessWindowsMicrosoft IisWindows Defender Atpkqltactic:Discoverytactic:Ransomware

    Community Inspired.
    AI Enhanced.
    Better Detections.

    Follow Us

    Company

    • About
    • Leaderboard

    Product

    • Community
    • Enterprise
    • Plans

    © 2026 Copyright. All Rights Reserved.

    Privacy PolicyTerms of Service

    Sign up to view this detection

    or

    Already have an account?