Use Icacls to Hide File to Everyone — Detection Rule

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Read the full analysis on IntelFusions