attrib.exe or PowerShell sets the Hidden attribute on a file

Siemphony@siemphonylowT1564.001unverified

AN0091 names two Windows mechanisms: attrib.exe setting the hidden attribute, and PowerShell commands doing the same. Both are single-event, literal observables on Sysmon EventID 1 and are what this rule matches -- attrib.exe invoked with the +h flag, or powershell.exe/pwsh.exe whose command line names both Attributes and Hidden, the shape of Set-ItemProperty -Name Attributes -Value Hidden and the equivalent (Get-Item ...).Attributes = 'Hidden' idiom. AN0091's other defender view -- "creating files with ADS" -- is deliberately left out: alternate data streams are a distinct concealment mechanism already covered by the sibling T1564.004 rule, and folding it in here would duplicate that selection rather than add a new one. AN0091's second logsource, Sysmon EventID 11 (file_event), is also left out: it carries only TargetFilename and the writing process, with no field for a file's attribute bits, so it can show a file was created but never that it was marked hidden. The other two analytics in this strategy are not attempted. AN0092's Linux observable -- a file or directory created with a leading '.' -- is real on the wire but not anomalous on its own: modern desktops and dev environments write dot-prefixed files constantly as ordinary behaviour (shell history, editor swap files, application caches, dotfile managers), which is exactly what MITRE's own DirectoryScope knob concedes by naming .ssh and .config as expected noise -- and DirectoryScope supplies no directory list to scope it with, so populating one here would be an invented value attributed to a MITRE knob that carries none. AN0093's macOS logsource ({product: macos, service: unifiedlog}) has no established Sigma field vocabulary anywhere in this corpus. Requires Sysmon installed and configured to log EventID 1 with CommandLine capture, which is Sysmon's default (unlike Security 4688, no separate audit policy is needed). UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0032, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 4 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Sentinel · KQL

Run this as a search.

DeviceProcessEvents| where ((FolderPath endswith "\\attrib.exe" and ProcessCommandLine contains "+h") or ((FolderPath endswith "\\powershell.exe" or FolderPath endswith "\\pwsh.exe") and (ProcessCommandLine contains "attributes" and ProcessCommandLine contains "hidden")))

Splunk · SPL

Run this as a search.

index=* ((Image="*\\attrib.exe" AND CommandLine="*+h*") OR ((Image="*\\powershell.exe" OR Image="*\\pwsh.exe") AND (CommandLine="*attributes*" AND CommandLine="*hidden*")))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE ((TO_LOWER(process.executable) LIKE "*\\\\attrib.exe" AND TO_LOWER(process.command_line) LIKE "*+h*") OR ((TO_LOWER(process.executable) LIKE "*\\\\powershell.exe" OR TO_LOWER(process.executable) LIKE "*\\\\pwsh.exe") AND (TO_LOWER(process.command_line) LIKE "*attributes*" AND TO_LOWER(process.command_line) LIKE "*hidden*")))

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

<group name="sigma,windows,process_creation,">  <!-- Rule ids must be unique on your manager; 100000+ is the user range. -->  <!-- 2 rules: the Sigma condition ORs across different fields,       which one rule cannot express. Any one matching is a hit. -->  <rule id="100000" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)\\attrib\.exe$</field>    <field name="CommandLine" type="pcre2">(?i)\+h</field>    <description>attrib.exe or PowerShell sets the Hidden attribute on a file (1/2)</description>    <mitre>      <id>T1564.001</id>    </mitre>  </rule>   <rule id="100001" level="5">    <!-- Set <if_sid> to the decoder/base rule for windows so this only evaluates relevant events. -->    <field name="Image" type="pcre2">(?i)(\\powershell\.exe$|\\pwsh\.exe$)</field>    <field name="CommandLine" type="pcre2">(?i)(?=.*(?:attributes))(?=.*(?:hidden)).*</field>    <description>attrib.exe or PowerShell sets the Hidden attribute on a file (2/2)</description>    <mitre>      <id>T1564.001</id>    </mitre>  </rule></group>

At a glance

Logsource: process_creation / windows
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 4 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 4adc6542-eae3-42b6-83c8-12339c6e138f

ATT&CKT1564.001

T1564.001Hidden Files and Directories

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

Two literal, single-event ways to mark a Windows file hidden: attrib.exe invoked with the +h flag, and a PowerShell command line naming both Attributes and Hidden — the shape of Set-ItemProperty -Name Attributes -Value Hidden or the (Get-Item ...).Attributes = 'Hidden' idiom. It does not cover AN0091's other defender view, alternate-data-stream concealment — that's a distinct mechanism already handled by the sibling T1564.004 rule — and it does not attempt AN0092's Linux dot-prefix hiding or AN0093's macOS UF_HIDDEN flag.

02 · Telemetry you need

Sysmon EventID 1 (process_creation) with CommandLine capture, which Sysmon logs by default — unlike Security 4688, no separate audit policy is required. Without Sysmon installed, this rule returns nothing.

03 · How the logic works

Two OR'd selections under condition: 1 of selection*: - selection_attrib: Image ends with \attrib.exe AND CommandLine contains +h. - selection_powershell: Image ends with \powershell.exe or \pwsh.exe AND CommandLine contains both attributes and hidden. AN0091's second logsource, Sysmon EventID 11 (file_event), is deliberately left out. It carries TargetFilename and the writing process but no field for a file's attribute bits — it can show a file was created, never that it was marked hidden. Including it would validate cleanly and match nothing real.

04 · Common false positives

Windows itself and many installers routinely set +h on marker files such as desktop.ini; backup, DLP and antivirus tooling commonly hides its own working folders with attrib.exe the same way.
Logon scripts and GPO-deployed batch files that hide a shared utility folder or config file from end users with attrib +h are the sanctioned administrative pattern the technique's own MITRE description names as the reason hidden files exist at all.
Package managers, IDEs and dotfile-management utilities written in PowerShell toggle the Hidden attribute on cache or config files during ordinary operation and will satisfy selection_powershell with no malicious intent.

05 · Detection maturity

tier_1: Lowest tier: authored, never executed. This rule has not been run against a single Sysmon log line. Both selections need to be fired against real attrib +h and PowerShell-hiding activity to confirm they actually match, and the false-positive list needs validating against a real environment's installer and AV baseline before this rule is trusted for anything beyond a scaffold.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

MITRE's AN0091 names two knobs, neither populated with real values in this rule: MonitoredExtensions (filter to sensitive extensions like .exe/.dll/.bat so the rule focuses on files worth hiding) and ADSMonitoring (a flag for the alternate-data-stream leg this rule does not implement). Beyond those, the pipeline's own suggestion for the encoded-command gap is a supplementary, lower-confidence selection on Image endswith powershell.exe/pwsh.exe AND CommandLine contains '-enc'/'-EncodedCommand'. If installer or AV noise dominates in a given environment, excluding those known process paths from selection_attrib is the next lever, though no such allowlist is populated here.

Declared by the author

Windows itself and many installers routinely set +h on marker files such as desktop.ini, and some backup, DLP or antivirus quarantine tooling hides its own working folders with attrib.exe as a matter of course, all indistinguishable from an adversary's use of the same flag.
Login scripts and Group Policy-deployed batch files that hide a shared utility folder or config file from end users with attrib +h as a routine, sanctioned administrative pattern -- the technique's own description names exactly this as the reason hidden files exist at all.
Package managers, IDE tooling and dotfile-management utilities implemented in PowerShell that toggle the Hidden attribute on cache or config files during normal operation, matching the powershell selection with no malicious intent.

Noise check0 of 30 fired

Fires on none of the 30 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 30 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.001, evaluated against their process_creation events.

Share this rule

/u/siemphony/4adc6542-eae3-42b6-83c8-12339c6e138f

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

attrib.exe or PowerShell sets the Hidden attribute on a file

The detection

detection.yml

Sentinel · KQL

Splunk · SPL

Elastic · ES|QL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it