Hiding Files with Attrib.exe — Detection Rule

Detects usage of attrib.exe to hide files from users.

Read the full analysis on IntelFusions