Hide Artifacts

// T1564 — Hide Artifacts: multi-signal detection across sub-techniques
// Signal 1: attrib command used to hide files or directories (T1564.001)
let HiddenFileAttrib = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "attrib.exe"
| where ProcessCommandLine has_any ("+h ", "+s ", "+h+s", "+s+h")
| extend Signal = "HiddenFileAttribute"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 2: NTFS Alternate Data Streams written via cmd/powershell (T1564.004)
let ADSCreation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @">\s*[^\s:]+:[^\\/:*?""<>|\s]+"
       or ProcessCommandLine has "Set-Content" and ProcessCommandLine matches regex @"-Path\s+[^:]+:[^\s]+"
       or ProcessCommandLine has "Out-File" and ProcessCommandLine matches regex @"-FilePath\s+[^:]+:[^\s]+"
| extend Signal = "NTFSAlternateDataStream"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 3: Scheduled task Security Descriptor (SD) registry value deletion (Tarrask — T1564)
let HiddenScheduledTask = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueDeleted"
| where RegistryKey has @"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"
| where RegistryValueName =~ "SD"
| extend Signal = "HiddenScheduledTaskSD"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
          FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine,
          RegistryKey, RegistryValueName,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 4: Hidden window flag used in scripting (T1564.003)
let HiddenWindow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("-WindowStyle Hidden", "-w hidden", "-WindowStyle h",
                                    "/windowstyle hidden", "SW_HIDE", "ShowWindow", "0x0 start")
| where FileName !in~ ("explorer.exe", "msiexec.exe", "svchost.exe")
| extend Signal = "HiddenWindowExecution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 5: Windows API calls to hide window via wscript/cscript/mshta
let HiddenScriptWindow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any ("//b ", "//B ", "CreateObject", "WScript.CreateObject")
| extend Signal = "HiddenScriptBatchMode"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 6: icacls or cacls used to deny Everyone/Users access to hide files (T1564.001)
let AccessDenialToHide = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("icacls.exe", "cacls.exe", "takeown.exe")
| where ProcessCommandLine has_any ("/deny Everyone", "/deny *S-1-1-0", "/deny Users", "/deny *S-1-5-32-545")
| extend Signal = "FileAccessDeniedToHide"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
          InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Union all signals
union HiddenFileAttrib, ADSCreation, HiddenScheduledTask, HiddenWindow, HiddenScriptWindow, AccessDenialToHide
| sort by Timestamp desc

| union
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\attrib.exe")
    | eval CommandLine=lower(CommandLine)
    | where match(CommandLine, "\+h|\+s")
    | eval Signal="HiddenFileAttribute"
    | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Signal ],
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
    | eval CommandLine=lower(CommandLine)
    | where match(CommandLine, ">[^:]+:[^\\\\/:*?\"<>|\s]+") OR
            (match(CommandLine, "set-content|out-file") AND match(CommandLine, ":[^\\\\]+"))
    | eval Signal="NTFSAlternateDataStream"
    | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Signal ],
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=13
    TargetObject="*\\Schedule\\TaskCache\\Tree\\*"
    | where match(TargetObject, "\\SD$") AND EventType="DeleteValue"
    | eval Signal="HiddenScheduledTaskSD"
    | eval CommandLine=ProcessCommandLine
    | table _time, host, User=UtcTime, Image, CommandLine, TargetObject, Signal ],
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    NOT (Image="*\\explorer.exe" OR Image="*\\msiexec.exe" OR Image="*\\svchost.exe")
    | eval CommandLine=lower(CommandLine)
    | where match(CommandLine, "-windowstyle\s+h|-w\s+hidden|sw_hide|//b\s|//b$")
    | eval Signal="HiddenWindowExecution"
    | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Signal ],
  [ search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
    (Image="*\\icacls.exe" OR Image="*\\cacls.exe")
    | eval CommandLine=lower(CommandLine)
    | where match(CommandLine, "/deny\s+(everyone|\*s-1-1-0|users|\*s-1-5-32-545)")
    | eval Signal="FileAccessDeniedToHide"
    | table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine, Signal ],
  [ search index=wineventlog sourcetype="WinEventLog:Security" EventCode=4698 OR EventCode=4702
    | eval TaskContent=lower(TaskContent)
    | where match(TaskContent, "hidden|runonlyidle|0x04")
    | eval Signal="SuspiciousScheduledTaskHidden"
    | eval CommandLine=TaskName
    | table _time, host, SubjectUserName, TaskName, Signal ]
| eval SuspicionScore=1
| stats sum(SuspicionScore) as TotalSignals, values(Signal) as Signals, values(CommandLine) as Commands,
        earliest(_time) as FirstSeen, latest(_time) as LastSeen by host, User
| where TotalSignals >= 1
| sort - TotalSignals

sequence by host.name with maxspan=1h
  [any where event.category == "process" and
    (
      (process.name : "attrib.exe" and process.args : ("+h", "+s", "+h+s", "+s+h")) or
      (process.name : ("cmd.exe", "powershell.exe", "pwsh.exe") and
        process.command_line : ("*>*:*", "*Set-Content*:*", "*Out-File*:*")) or
      (process.name : ("powershell.exe", "pwsh.exe", "cmd.exe", "wscript.exe", "cscript.exe") and
        process.command_line : ("-WindowStyle Hidden", "-w hidden", "-WindowStyle h", "//b ", "//B ", "SW_HIDE")) or
      (process.name : ("icacls.exe", "cacls.exe") and
        process.command_line : ("/deny Everyone*", "/deny *S-1-1-0*", "/deny Users*", "/deny *S-1-5-32-545*"))
    )
  ] by host.name
| sequence by host.name with maxspan=24h
  [process where event.type == "start" and
    process.name : "attrib.exe" and process.args : ("+h", "+s")]
  [registry where registry.path : "*\\Schedule\\TaskCache\\Tree\\*" and
    registry.value : "SD" and event.action : "deletion"]

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS EventTime,
  logsourcename(logsourceid) AS LogSource,
  sourceip AS HostIP,
  username AS UserName,
  QIDNAME(qid) AS EventName,
  "ProcessPath" AS ProcessImage,
  "CommandLine" AS CommandLine,
  "ParentProcessPath" AS ParentImage,
  CASE
    WHEN LOWER("CommandLine") MATCHES '.*attrib.*\+h.*|.*attrib.*\+s.*' THEN 'HiddenFileAttribute'
    WHEN LOWER("CommandLine") MATCHES '.*>[^:]+:[^\\/:*?"<>|\s]+.*' THEN 'NTFSAlternateDataStream'
    WHEN LOWER("CommandLine") MATCHES '.*-windowstyle\s+h.*|-w\s+hidden.*|.*sw_hide.*|.*/\/b\s.*' THEN 'HiddenWindowExecution'
    WHEN LOWER("CommandLine") MATCHES '.*/deny\s+(everyone|\*s-1-1-0|users|\*s-1-5-32-545).*' THEN 'FileAccessDeniedToHide'
    WHEN LOWER("TargetObject") MATCHES '.*\\schedule\\taskcache\\tree\\.*' THEN 'HiddenScheduledTaskSD'
    ELSE 'HideArtifactGeneric'
  END AS Signal
FROM events
WHERE
  LOGSOURCETYPEID(logsourceid) IN (13, 14, 15, 65)  -- Windows Security, Sysmon
  AND categoryname(category) IN ('Application Activity', 'Access Control', 'Audit')
  AND (
    ("ProcessPath" IMATCHES '%\\attrib.exe' AND LOWER("CommandLine") MATCHES '.*\+h.*|.*\+s.*')
    OR
    ("ProcessPath" IMATCHES '%\\(cmd.exe|powershell.exe|pwsh.exe)'
      AND (LOWER("CommandLine") MATCHES '.*>[^:]+:[^\\/:*?"<>|]+.*'
           OR (LOWER("CommandLine") MATCHES '.*(set-content|out-file).*' AND LOWER("CommandLine") MATCHES '.*:[^\\]+.*')))
    OR
    (LOWER("CommandLine") MATCHES '.*(-windowstyle\s+hidden|-w\s+hidden|sw_hide|\/\/b\s|\/\/b$).*'
      AND "ProcessPath" NOT IMATCHES '%(explorer.exe|msiexec.exe|svchost.exe)')
    OR
    ("ProcessPath" IMATCHES '%(icacls.exe|cacls.exe)'
      AND LOWER("CommandLine") MATCHES '.*/deny\s+(everyone|\*s-1-1-0|users|\*s-1-5-32-545).*')
    OR
    (LOWER("TargetObject") MATCHES '.*\\schedule\\taskcache\\tree\\.*sd$'
      AND "EventType" = 'DeleteValue')
  )
  AND starttime > NOW() - 86400000
ORDER BY starttime DESC
LIMIT 1000

(_sourceCategory=*windows* OR _sourceCategory=*sysmon* OR _sourceCategory=*WinEventLog*)
| where EventCode in ("1", "13") OR EventID in ("1", "13", "4698", "4702")
| parse field=CommandLine "*" as cmd nodrop
| parse field=Image "*\\*" as _dir, ProcessName nodrop
| parse field=TargetObject "*\\Schedule\\TaskCache\\Tree\\*" as _pre, TaskPath nodrop
| eval cmd_lower = toLowerCase(cmd)
// Signal classification
| eval Signal =
    if (ProcessName = "attrib.exe" AND (cmd_lower matches "(?i).*\+h.*" OR cmd_lower matches "(?i).*\+s.*"),
        "HiddenFileAttribute",
    if (ProcessName in ("cmd.exe", "powershell.exe", "pwsh.exe") AND
        (cmd_lower matches ".*>[^:]+:[^\\/:*?\"<>|\\s]+.*"
         OR (cmd_lower matches ".*set-content.*" AND cmd_lower matches ".*:[^\\\\]+.*")
         OR (cmd_lower matches ".*out-file.*" AND cmd_lower matches ".*:[^\\\\]+.*")),
        "NTFSAlternateDataStream",
    if (cmd_lower matches "(?i).*-windowstyle\s+h.*|.*-w\s+hidden.*|.*sw_hide.*|\/\/b\s|\/\/b$"
        AND NOT ProcessName in ("explorer.exe", "msiexec.exe", "svchost.exe"),
        "HiddenWindowExecution",
    if (ProcessName in ("icacls.exe", "cacls.exe") AND
        cmd_lower matches "(?i).*/deny\s+(everyone|\*s-1-1-0|users|\*s-1-5-32-545).*",
        "FileAccessDeniedToHide",
    if (EventCode = "13" AND cmd_lower matches ".*\\schedule\\taskcache\\tree\\.*"
        AND EventType = "DeleteValue" AND TargetObject matches ".*\\SD$",
        "HiddenScheduledTaskSD",
    "Unknown")))))
| where Signal != "Unknown"
| count as SignalCount by host, User, Signal, ProcessName, cmd, _time
| timeslice 1h
| stats sum(SignalCount) as TotalSignals, values(Signal) as Signals, values(cmd) as Commands,
         min(_timeslice) as FirstSeen, max(_timeslice) as LastSeen by host, User
| where TotalSignals >= 1
| sort by TotalSignals desc

rule T1564_HideArtifacts_MultiSignal {
  meta:
    name = "T1564 - Hide Artifacts Multi-Signal Detection"
    description = "Detects multiple artifact hiding techniques: attrib +h/+s, NTFS ADS creation, hidden window execution, file access denial, and Tarrask scheduled task SD deletion"
    author = "Argus Detection Engineering"
    mitre_attack = "T1564"
    severity = "HIGH"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-21"

  events:
    (
      // Signal 1: attrib.exe setting hidden/system attributes
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i).*\\attrib\.exe$`)
        and re.regex($e.target.process.command_line, `(?i).*\+[hs].*`)
      )
      or
      // Signal 2: NTFS Alternate Data Streams via shell
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i).*\\(cmd|powershell|pwsh)\.exe$`)
        and (
          re.regex($e.target.process.command_line, `>[^:]+:[^\\/:\*\?"<>|\s]+`)
          or (
            re.regex($e.target.process.command_line, `(?i)(Set-Content|Out-File)`)
            and re.regex($e.target.process.command_line, `:[^\\]+`)
          )
        )
      )
      or
      // Signal 3: Hidden window execution flags
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.command_line, `(?i)(-WindowStyle\s+[Hh]|-w\s+hidden|SW_HIDE|\/\/[Bb]\s)`)
        and not re.regex($e.target.process.file.full_path, `(?i).*\\(explorer|msiexec|svchost)\.exe$`)
      )
      or
      // Signal 4: icacls/cacls used to deny access
      (
        $e.metadata.event_type = "PROCESS_LAUNCH"
        and re.regex($e.target.process.file.full_path, `(?i).*\\(icacls|cacls)\.exe$`)
        and re.regex($e.target.process.command_line, `(?i)/deny\s+(Everyone|\*S-1-1-0|Users|\*S-1-5-32-545)`)
      )
      or
      // Signal 5: Scheduled task SD registry deletion (Tarrask)
      (
        $e.metadata.event_type = "REGISTRY_MODIFICATION"
        and re.regex($e.target.registry.registry_key, `(?i).*\\Schedule\\TaskCache\\Tree\\.*`)
        and $e.target.registry.registry_value_name = "SD"
        and $e.metadata.event_subtype = "REGISTRY_DELETION"
      )
    )

  condition:
    $e
}

// T1564 — Hide Artifacts: Multi-signal detection across sub-techniques
// Signal 1: attrib.exe setting hidden or system file attributes
#event_simpleName=ProcessRollup2
| FileName = "attrib.exe"
| regex field=CommandLine "(?i)(\+h|\+s)"
| eval Signal="HiddenFileAttribute"
| table([_time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal])

// Signal 2: NTFS Alternate Data Streams via cmd/powershell
| union [
  #event_simpleName=ProcessRollup2
  | FileName in ("cmd.exe", "powershell.exe", "pwsh.exe")
  | regex field=CommandLine ">[^:]+:[^\\/:\*\?\"<>|\s]+"
    OR (CommandLine = /(?i)(set-content|out-file)/ AND CommandLine = /:([^\\]+)/)
  | eval Signal="NTFSAlternateDataStream"
  | table([_time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal])
]

// Signal 3: Hidden window execution via PowerShell/scripting engines
| union [
  #event_simpleName=ProcessRollup2
  | FileName != "explorer.exe"
  | FileName != "msiexec.exe"
  | FileName != "svchost.exe"
  | regex field=CommandLine "(?i)(-WindowStyle\s+[Hh]|-w\s+hidden|SW_HIDE|//[Bb]\s)"
  | eval Signal="HiddenWindowExecution"
  | table([_time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal])
]

// Signal 4: icacls or cacls used to deny Everyone/Users file access
| union [
  #event_simpleName=ProcessRollup2
  | FileName in ("icacls.exe", "cacls.exe")
  | regex field=CommandLine "(?i)/deny\s+(Everyone|\*S-1-1-0|Users|\*S-1-5-32-545)"
  | eval Signal="FileAccessDeniedToHide"
  | table([_time, ComputerName, UserName, FileName, CommandLine, ParentBaseFileName, Signal])
]

// Signal 5: Scheduled task SD registry value deletion (Tarrask)
| union [
  #event_simpleName=RegValueDeleteValue
  | regex field=TargetObject "(?i).*\\Schedule\\TaskCache\\Tree\\.*"
  | TargetValueName = "SD"
  | eval Signal="HiddenScheduledTaskSD"
  | eval CommandLine=InitiatingProcessCommandLine
  | table([_time, ComputerName, UserName, InitiatingProcessFileName, CommandLine, TargetObject, Signal])
]

// Aggregate all signals
| groupBy([ComputerName, UserName], function=[
    count(as=TotalSignals),
    collect(Signal, as=AllSignals),
    collect(CommandLine, as=Commands),
    min(_time, as=FirstSeen),
    max(_time, as=LastSeen)
  ])
| TotalSignals >= 1
| sort(TotalSignals, order=desc)