Abuse of Windows Attrib.exe to Hide Malicious Files

The Windows binary attrib.exe is a legitimate system utility used to display or change file attributes. Threat actors frequently abuse this tool to perform defense evasion by marking malicious files, tools, or persistence mechanisms with the hidden (+h) attribute. This technique renders files invisible to standard Windows Explorer views and may bypass basic security inspection that does not account for hidden directory content. This behavior has been associated with various malicious activities, including the deployment of information stealers (such as Azorult and crypto stealers), keyloggers, and the use of malicious installers like Inno Setup loaders. Defenders monitoring endpoint process creation should focus on the use of attrib.exe with the +h argument, as this is rarely necessary for standard administrative tasks in many environments.

Impact

Successful execution of this technique allows attackers to persist in the environment undetected by hiding secondary payloads and post-exploitation tools. This contributes to long-term dwelling and complicates incident response efforts by obscuring evidence on the infected host.

Recommendation

Deploy the provided Sigma rule to monitor for suspicious process execution of attrib.exe with the hidden attribute flag. Ensure that EDR telemetry, specifically process command-line arguments and parent process information, is being ingested and normalized to the Endpoint data model to support this detection.