{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/tags/file-hiding/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":[],"_cs_cves":[],"_cs_exploited":false,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":[],"_cs_severities":["medium"],"_cs_tags":["defense-evasion","file-hiding","persistence","windows","endpoint"],"_cs_type":"advisory","_cs_vendors":[],"content_html":"\u003cp\u003eThe Windows binary attrib.exe is a legitimate system utility used to display or change file attributes. Threat actors frequently abuse this tool to perform defense evasion by marking malicious files, tools, or persistence mechanisms with the hidden (+h) attribute. This technique renders files invisible to standard Windows Explorer views and may bypass basic security inspection that does not account for hidden directory content. This behavior has been associated with various malicious activities, including the deployment of information stealers (such as Azorult and crypto stealers), keyloggers, and the use of malicious installers like Inno Setup loaders. Defenders monitoring endpoint process creation should focus on the use of attrib.exe with the +h argument, as this is rarely necessary for standard administrative tasks in many environments.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eSuccessful execution of this technique allows attackers to persist in the environment undetected by hiding secondary payloads and post-exploitation tools. This contributes to long-term dwelling and complicates incident response efforts by obscuring evidence on the infected host.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003eDeploy the provided Sigma rule to monitor for suspicious process execution of attrib.exe with the hidden attribute flag. Ensure that EDR telemetry, specifically process command-line arguments and parent process information, is being ingested and normalized to the Endpoint data model to support this detection.\u003c/p\u003e\n","date_modified":"2026-10-12T17:46:48Z","date_published":"2026-10-12T17:46:48Z","id":"https://feed.craftedsignal.io/briefs/2026-10-hiding-files-attrib-exe/","summary":"Attackers abuse the Windows attrib.exe binary with the +h flag to conceal malicious files and directories from users and security software as part of a defense evasion strategy.","title":"Abuse of Windows Attrib.exe to Hide Malicious Files","url":"https://feed.craftedsignal.io/briefs/2026-10-hiding-files-attrib-exe/"}],"language":"en","title":"CraftedSignal Threat Feed - File-Hiding","version":"https://jsonfeed.org/version/1.1"}