Hiding Files with Attrib.exe

Status: test
Severity: medium
Log source: category process_creation, product windows
Author: Sami Ruohonen
Source: github.com/SigmaHQ/sigma

Detects usage of attrib.exe to hide files from users.

Known false positives

IgfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe)
Msiexec.exe hiding desktop.ini

MITRE ATT&CK coverage

Tactic	Techniques
Stealth	`T1564.001` Hide Artifacts: Hidden Files and Directories

Telemetry coverage

Provider	Record / event type
Sysmon	Event ID 1: Process creation

Rule body

title: Hiding Files with Attrib.exe
id: 4281cb20-2994-4580-aa63-c8b86d019934
status: test
description: Detects usage of attrib.exe to hide files from users.
references:
    - https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/
    - https://www.uptycs.com/blog/lolbins-are-no-laughing-matter
author: Sami Ruohonen
date: 2019-01-16
modified: 2023-03-14
tags:
    - attack.stealth
    - attack.t1564.001
logsource:
    category: process_creation
    product: windows
detection:
    selection_img:
        - Image|endswith: '\attrib.exe'
        - OriginalFileName: 'ATTRIB.EXE'
    selection_cli:
        CommandLine|contains: ' +h '
    filter_main_msiexec:
        CommandLine|contains: '\desktop.ini '
    filter_optional_intel:
        ParentImage|endswith: '\cmd.exe'
        CommandLine: '+R +H +S +A \\\*.cui'
        ParentCommandLine: 'C:\\WINDOWS\\system32\\\*.bat'
    condition: all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*
falsepositives:
    - IgfxCUIService.exe hiding *.cui files via .bat script (attrib.exe a child of cmd.exe and igfxCUIService.exe is the parent of the cmd.exe)
    - Msiexec.exe hiding desktop.ini
level: medium

Stages and Predicates

Stage 0: `condition`

all of selection_* and not 1 of filter_main_* and not 1 of filter_optional_*

Stage 1: `selection_img`

selection_img:
    - Image|endswith: '\attrib.exe'
    - OriginalFileName: 'ATTRIB.EXE'

Stage 2: `selection_cli`

selection_cli:
    CommandLine|contains: ' +h '

Stage 3: `not filter_main_msiexec`

filter_main_msiexec:
    CommandLine|contains: '\desktop.ini '

Stage 4: `not filter_optional_intel`

filter_optional_intel:
    ParentImage|endswith: '\cmd.exe'
    CommandLine: '+R +H +S +A \\\*.cui'
    ParentCommandLine: 'C:\\WINDOWS\\system32\\\*.bat'

Exclusions

The rule actively suppresses these predicates.

Field	Kind	Excluded values	Search
`CommandLine`	match	`\desktop.ini`	`excludes:CommandLine` `field:"CommandLine" value:"\desktop.ini "`
`CommandLine`	eq	`+R +H +S +A \\\*.cui`	`excludes:CommandLine` `field:"CommandLine" value:"+R +H +S +A \\\*.cui"`
`ParentCommandLine`	eq	`C:\\WINDOWS\\system32\\\*.bat`	`excludes:ParentCommandLine` `field:"ParentCommandLine" value:"C:\\WINDOWS\\system32\\\*.bat"`
`ParentImage`	ends_with	`\cmd.exe`	`excludes:ParentImage` `field:"ParentImage" value:"\cmd.exe"`

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`CommandLine`	match	`+h` corpus 2 (sigma 2)	`field:"CommandLine" kind:match value:" +h "`
`Image`	ends_with	`\attrib.exe` corpus 5 (sigma 5)	`field:"Image" kind:ends_with value:"\attrib.exe"`
`OriginalFileName`	eq	`ATTRIB.EXE` corpus 5 (sigma 3, elastic 2)	`field:"OriginalFileName" kind:eq value:"ATTRIB.EXE"`

Hiding Files with Attrib.exe

Known false positives

MITRE ATT&CK coverage

Telemetry coverage

Rule body

Stages and Predicates

Stage 0: condition

Stage 1: selection_img

Stage 2: selection_cli

Stage 3: not filter_main_msiexec

Stage 4: not filter_optional_intel

Exclusions

Indicators

Stage 0: `condition`

Stage 1: `selection_img`

Stage 2: `selection_cli`

Stage 3: `not filter_main_msiexec`

Stage 4: `not filter_optional_intel`