Attrib hide file
attrib +h marking a file or directory hidden.
What it detects
attrib +h marking a file or directory hidden. On its own this is a trivial command; it earns a finding because of when it appears — immediately after tooling is staged, to keep an operator's working directory out of sight of whoever is sitting at the machine. Combined with +s (system) the item is hidden even from users who have enabled "show hidden files".
Kept at medium severity deliberately: this is corroborating evidence that sharpens a timeline, not a standalone incident.
MITRE ATT&CK mapping
- T1564.001Hide Artifacts: Hidden Files and Directories· Defense Evasion
False positives and triage
Legitimate installers and batch scripts do hide configuration and cache files, so expect a low background rate on developer and admin machines.
To confirm: the target path is what matters. A file in the same directory as recently created tooling, or a directory under \Users\Public, \ProgramData or a temp path, is the finding; a vendor's own config file under Program Files is not. Read the surrounding process tree — this command is nearly always one line of a longer script, and the lines around it are more informative than the hide itself.
The rule
Declarative YAML read by the detection engine — data, never executed. Confidence 60%. Source: rules/windows/attrib_hide_file.yaml, licensed under the Apache License 2.0.
id: windows.defense_evasion.attrib_hide_file
version: 1.0.0
status: stable
severity: medium
confidence: 0.6
platforms: [windows]
mitre_techniques: [T1564.001]
description: |
`attrib +h` marking a file or directory hidden. On its own this is a trivial
command; it earns a finding because of when it appears — immediately after tooling
is staged, to keep an operator's working directory out of sight of whoever is
sitting at the machine. Combined with `+s` (system) the item is hidden even from
users who have enabled "show hidden files".
Kept at medium severity deliberately: this is corroborating evidence that sharpens
a timeline, not a standalone incident.
match:
process_name_contains_any: [attrib]
command_line_regex: '(?i)\s\+[a-z]*h'
correlation_keys: [hostname, user_name]
false_positive_guidance: |
Legitimate installers and batch scripts do hide configuration and cache files, so
expect a low background rate on developer and admin machines.
To confirm: the target path is what matters. A file in the same directory as
recently created tooling, or a directory under `\Users\Public`, `\ProgramData` or
a temp path, is the finding; a vendor's own config file under `Program Files` is
not. Read the surrounding process tree — this command is nearly always one line of
a longer script, and the lines around it are more informative than the hide itself.
Related detections
Run this rule on your own logs — offline
KIROSEC runs this rule and the rest of the library over Windows, Linux, macOS and cloud audit logs on the analyst's own machine. Every alert links to the events that raised it, and nothing leaves the device.