SEKOIA.IO Rules medium stable sigma

Hiding Files With Attrib.exe

Detects usage of attrib.exe to hide files from users.

View Source

Detection Logic

selection1:
  process.name: attrib.exe
  process.command_line
| contains: " +h "
selection2:
  process.command_line
| contains: +R +H +S +A \*.cui
selection3:
  process.command_line
| contains: \desktop.ini
selection4:
  process.command_line
| contains: c:\windows\temp
condition: selection1 and not (selection2 or selection3 or selection4)

Field Validations

Loading…

Comments (0)

Loading comments...