Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
IDS Protocols
4
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects file and directory hiding techniques associated with Mustang Panda implants (e.g., SHARDLOADER, ZOHOMURK) by monitoring for the usage of 'attrib.exe' to set the hidden (+h) attribute, or the usage of 'icacls.exe' to manipulate access permissions within sensitive directories like ProgramData or AppData, which may be indicative of malicious artifact concealment.
Detects Remcos RAT installation activity characterized by file creation under C:\ProgramData\Remcos\ followed by the use of Windows system utilities like attrib.exe or icacls.exe to apply system, hidden, or restricted attributes to the directory or executable, effectively concealing the malware from the user.
Detects SMB traffic patterns containing commands indicative of file obfuscation or permission tampering, specifically the use of 'attrib' to set hidden or system attributes, 'icacls' to deny access to files, or PowerShell execution with the '-WindowStyle Hidden' argument.
Detects techniques used by adversaries to hide files, directories, or modify access permissions on Windows systems. This includes the use of 'attrib.exe' to set the hidden attribute, PowerShell cmdlets to set file attributes, 'icacls' to modify or deny permissions, and the creation of hidden Unix-style dot-prefixed files within common Windows user directories.
Detects the use of the attrib.exe utility to modify file attributes by applying the hidden (+h), system (+s), and read-only (+r) flags simultaneously to files located within the ProgramData directory. This behavior is a common technique used by malware to hide artifacts from users and evade basic detection while attempting to prevent accidental deletion or modification.
Detects DcRAT malware creating or modifying a specific file (c:\debug.txt) used for staging keylogging or screenshot data. This rule monitors for file creation followed by modification events, a pattern associated with the adversary's method of log consolidation and potential obfuscation.
Detects SMB traffic patterns containing commands indicative of file obfuscation or permission tampering, specifically the use of 'attrib' to set hidden or system attributes, 'icacls' to deny access to files, or PowerShell execution with the '-WindowStyle Hidden' argument.
Detects the Remcos RAT using the Windows 'attrib.exe' utility to apply hidden, system, and read-only file attributes to its installation directory within %ProgramData%\Remcos to evade detection and forensic analysis.
Detects the use of the Windows attrib.exe utility to set the hidden file attribute (+h) on files. Adversaries often use this technique to hide malicious files, scripts, or directories from standard file browsing tools to evade detection. The rule includes an exclusion for processes signed by Microsoft to reduce noise from legitimate system operations.
Detects the use of the Windows attrib.exe command with the +h (hidden) attribute flag applied to files within the AppData\Roaming or AppData\Local directories. This behavior is commonly associated with malware attempting to hide malicious components for persistence or evasion.
Detects miner binaries and watchdog scripts associated with the CVE-2026-33017 Langflow cryptominer campaign being staged in hidden directories under /var/tmp, specifically /var/tmp/.xlamb/ and related files used to evade detection. The rule looks for file events or process events where the folder path or file name matches known indicators like '/var/tmp/.xlamb', '/var/tmp/init_rmount', 'lambsys', 'lambsys.elf', or 'init_rmount', or if the process command line contains these paths/filenames.
Detects the use of the Windows attrib.exe utility to modify file attributes, specifically targeting the addition of hidden (+h) or system (+s) attributes. The rule looks for these modifications in suspicious locations or contexts, such as ProgramData, IDM log directories, or in association with specific application filenames, which may indicate attempts to hide malicious files or persistence mechanisms.
Detects the use of the Windows 'attrib.exe' utility to set the hidden (+h) attribute on files or directories within 'ProgramData' or 'AppData' paths. This behavior is frequently associated with the Mustang Panda threat group to conceal malicious artifacts, such as the SHARDLOADER and ZOHOMURK implants, from standard user visibility.
Detects Gamaredon Group activity involving the staging of malicious payloads using NTFS Alternate Data Streams (ADS) and hidden file attributes (PteroCache/PteroOdd). The rule monitors for three primary staging behaviors: the creation of ADS files via script interpreters (Office, wscript, PowerShell), the modification of file attributes to hidden or system (+H/+S) in sensitive paths, and the enumeration of ADS streams using 'dir /R'. These staging actions are correlated with subsequent process execution from user-writable directories (e.g., APPDATA, TEMP) within a 5-minute window to identify the full infection chain.
This rule monitors for the execution of QEMU processes and the creation of virtual disk files (.qcow2, .vmdk) in non-standard locations. It also identifies potentially disguised VM images by detecting files with suspicious extensions (.db, .dll) created in sensitive paths like Temp or AppData, which may indicate an attempt to hide virtualized environments or disk images.
Detects UNG002's tactic of hiding malicious VBScripts 4+ levels deep in folders mimicking macOS metadata (__MACOSX) to evade automated scanners.
Detects suspicious modifications to file permissions and attributes on specific artifacts (lambsys, procq, isp.sh) known to be associated with the Lambsys cryptominer campaign. The rule monitors for execution of chmod or chattr on these artifacts, or any generic chmod activity within /tmp or /var/tmp directories.
Detects the creation or modification of a file named 'logs.dat' within the 'AppData\Roaming\DT\' directory by processes other than 'explorer.exe' or 'system'. This pattern is often indicative of malware or unwanted programs attempting to establish persistence or store data in a hidden or less scrutinized location.
Detects the use of the Windows attrib.exe utility to set the hidden file attribute (+h) on files. Adversaries often use this technique to hide malicious files, scripts, or directories from standard file browsing tools to evade detection. The rule includes an exclusion for processes signed by Microsoft to reduce noise from legitimate system operations.
Detects the use of attrib.exe with the '+h' flag to hide files or directories within common user-specific folders such as AppData, Temp, or Roaming. This activity is often associated with adversaries attempting to conceal their presence or malicious files.
Page 2 of 6