Detects the execution of "attrib" with the "+s" flag to mark files as system files
Read the full analysis on IntelFusions