Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
17 detections
Filters
Last updated
All Time
Detection languages
6
6
2
1
1
Contributors
5
4
2
2
1
Categories
13
12
8
2
1
Platforms
17
Products / Services
6
6
6
3
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
Detects the use of the attrib.exe utility to modify file attributes by applying the hidden (+h), system (+s), and read-only (+r) flags simultaneously to files located within the ProgramData directory. This behavior is a common technique used by malware to hide artifacts from users and evade basic detection while attempting to prevent accidental deletion or modification.
Detects the use of the Windows attrib.exe command with the +h (hidden) attribute flag applied to files within the AppData\Roaming or AppData\Local directories. This behavior is commonly associated with malware attempting to hide malicious components for persistence or evasion.
Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.
Detects the use of attrib.exe with the '+h' flag to hide files or directories within common user-specific folders such as AppData, Temp, or Roaming. This activity is often associated with adversaries attempting to conceal their presence or malicious files.
Detects Python processes executing the 'attrib +h' command. This behavior was observed in the malicious telnyx PyPI package, which uses it to hide its execution lock file on Windows systems and avoid detection.
Detects the use of attrib.exe to set system (+s) and hidden (+h) attributes on an executable file in a suspicious folder. This technique was observed being used by threat actors to hide payloads like SparkRAT.
Detects the use of the 'attrib.exe' utility to set the hidden attribute on a .lnk file. Adversaries may use this technique to hide malicious shortcuts used for persistence or initial execution.
Detects various suspicious activities associated with the HAFNIUM threat group targeting Microsoft Exchange servers. This includes attempts to hide files using `attrib`, scheduled task creation for persistence, execution of an unusual Opera browser, shadow copy enumeration, and data staging/exfiltration using `makecab`, `7zip`, and `rundll32` for minidump creation.
This detection identifies the use of attrib.exe to remove hidden (-h) or system (-s) attributes from the Default.rdp file, which is automatically created in a user's Documents folder when a Remote Desktop Protocol (RDP) session is initiated using mstsc.exe. The Default.rdp file stores session configuration details such as the remote host address and screen settings. Unhiding this file is uncommon in normal user behavior and may indicate that an attacker or red team operator is attempting to access or manipulate RDP connection history that was previously hidden—either by default or as part of an earlier anti-forensics effort. This activity may represent part of a broader pattern of reconnaissance or staging for credential reuse, lateral movement, or forensic analysis evasion. Monitoring for this behavior can help uncover suspicious manipulation of user artifacts and highlight interactive attacker activity on a compromised host.
The following analytic detects the use of the Windows binary attrib.exe to hide files or directories by marking them with specific flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments that include the "+h" flag. This activity is significant because hiding files can be a tactic used by attackers to conceal malicious files or tools from users and security software. If confirmed malicious, this behavior could allow an attacker to persist in the environment undetected, potentially leading to further compromise or data exfiltration.
This query was originally published in the threat analytics report, Adwind utilizes Java for cross-platform impact.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
Adwind is a remote access tool (RAT) that takes advantage of the cross-platform capabilities of the Java framework. It can check which operating system a target is running and adapt accordingly, allowing it to successfully compromise both Windows and macOS devices.
The query below checks for attempts to disguise Java class files (i.e., complied code with a .class extension). Although the behavior detected by this query is typical of attacks that use Adwind malware, unrelated attacks may use the same or similar defense evasion techniques.
See Detecting a JAR attachment for an additional query that detects behavior associated with Adwind attacks.
Prior to deploying Macaw ransomware in an organization, adversaries wil use Attrib to display file attribute information on multiple drives and all subfolders.
Detects the execution of the `attrib.exe` utility with the `+s` flag, which is used to mark files as system files. This technique can be used by adversaries to hide malicious files from users and some security tools, contributing to defense evasion.
Detects the use of Jlaive, a hack tool, to execute assemblies in a copied PowerShell instance. This technique involves using `xcopy.exe` to copy `powershell.exe` or `pwsh.exe` to a new name ending with `.bat.exe`, and then using `attrib.exe` to set system and hidden attributes on this file, likely to evade detection and execute malicious code.
This rule detects the use of the `attrib.exe` utility to hide files by setting the hidden attribute (`+h`). Adversaries often use this technique to conceal malicious files or directories from users and basic forensic analysis, aiding in defense evasion. The rule specifically looks for the execution of `attrib.exe` with the `+h` command-line argument.
Detects the usage of `attrib.exe` with the `+s` option to set scripts or executables located in suspicious directories as system files. This technique is used to hide files from users and prevent them from being easily deleted. The rule specifically targets common suspicious locations and file extensions to reduce false positives.