attrib.exe — DÆMON

Hide Artifacts

NEW

Defense Evasion Windows

The built-in attrib command sets the Hidden (+h) and System (+s) file attributes so a file is concealed from default Explorer and 'dir' views, a simple way to hide dropped artifacts on disk.

Use Conceal a dropped executable or staging file from casual inspection of a directory.

attrib +h +s C:\Windows\Temp\x\payload.exe

Context: user
Native: Hide Artifacts, Hidden Files and Directories
MITRE: T1564.001
Detection: Detection: Log process creation (Sysmon 1 / 4688) for attrib.exe with '+h' and especially '+s' on files in user-writable paths (Temp, ProgramData, AppData). Hunt the file system for files carrying both Hidden and System attributes in atypical locations.
Verified: ✓ MS Learn attrib doc confirms '{+|-}h' sets the Hidden and '{+|-}s' sets the System file attribute; ATT&CK T1564.001. No change.
Refs: attack.mitre.org/techniques/T1564/001/
learn.microsoft.com/en-us/windows-server/administration/windows-commands/attrib