T1564.001 Hidden Files and Directories Detection — KQL & SPL Queries for Sentinel and Splunk

Microsoft Sentinel / Defender

kusto

DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "attrib.exe"
| where ProcessCommandLine has "+h" or ProcessCommandLine has "+s" or ProcessCommandLine has "+r"
| extend HiddenAttr = ProcessCommandLine has "+h"
| extend SystemAttr = ProcessCommandLine has "+s"
| extend ReadOnly = ProcessCommandLine has "+r"
| extend SuspiciousTarget = ProcessCommandLine has_any ("Temp", "AppData", "ProgramData", "Recycle", "Windows")
| extend SuspiciousParent = InitiatingProcessFileName has_any ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName,
         HiddenAttr, SystemAttr, ReadOnly, SuspiciousTarget, SuspiciousParent
| sort by Timestamp desc
union (
  DeviceFileEvents
  | where Timestamp > ago(24h)
  | where ActionType == "FileAttributesModified"
  | where AdditionalFields has "Hidden"
  | project Timestamp, DeviceName, AccountName, FileName, FolderPath, InitiatingProcessFileName, AdditionalFields
  | sort by Timestamp desc
)

medium severity medium confidence

Data Sources

Process: Process Creation File: File Modification Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents DeviceFileEvents

False Positives

System administrators using attrib.exe to hide configuration directories or sensitive files from user view
Software installers that mark their data directories as hidden to prevent accidental user modification
Windows system processes that legitimately set hidden/system attributes on operating system files and directories
Backup software that marks shadow copy-related directories as hidden and system

Splunk

spl

index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
Image="*\\attrib.exe"
| eval HiddenAttr=if(match(CommandLine, "\+h"), 1, 0)
| eval SystemAttr=if(match(CommandLine, "\+s"), 1, 0)
| eval SuspiciousTarget=if(match(CommandLine, "(Temp|AppData|ProgramData|Recycle|Windows\\System)"), 1, 0)
| eval SuspiciousParent=if(match(ParentImage, "(cmd|powershell|wscript|cscript)\.exe"), 1, 0)
| eval RiskScore=HiddenAttr + SystemAttr + SuspiciousTarget + SuspiciousParent
| where RiskScore > 1
| table _time, host, User, CommandLine, ParentImage, HiddenAttr, SystemAttr, SuspiciousTarget, SuspiciousParent, RiskScore
| sort - _time

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Sysmon Event ID 1

Required Sourcetypes

XmlWinEventLog:Microsoft-Windows-Sysmon/Operational

False Positives

System administrators using attrib.exe for legitimate file management
Software installers marking data directories as hidden
Windows system processes setting hidden/system attributes on OS files
Backup software operations on shadow copy directories

Elastic Security (EQL)

eql

sequence by host.name with maxspan=5m
  [process where event.type == "start"
    and process.name : "attrib.exe"
    and (
      process.args : "+h" or
      process.args : "+s" or
      process.args : "+r"
    )
    and (
      process.args : ("*Temp*", "*AppData*", "*ProgramData*", "*Recycle*", "*Windows*")
      or process.parent.name : ("cmd.exe", "powershell.exe", "wscript.exe", "cscript.exe", "mshta.exe")
    )
  ] by process.entity_id

OR

process where event.type == "start"
  and process.name : "attrib.exe"
  and process.args : "+h"
  and process.args : "+s"

medium severity high confidence

Data Sources

Elastic Endpoint Security Auditbeat Winlogbeat (Sysmon)

Required Tables

logs-endpoint.events.process-* winlogbeat-*

False Positives

Legitimate software installers or package managers setting hidden attributes on configuration or cache files during normal installation
System administrators running scripts that use attrib.exe to protect critical configuration files from accidental deletion
Backup or imaging software that marks its staging directories as hidden and system to prevent interference

IBM QRadar (AQL)

sql

SELECT
  DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
  sourceip,
  username,
  "Process Name",
  "Command",
  "Parent Process Name",
  CASE
    WHEN "Command" ILIKE '%+h%' THEN 1 ELSE 0
  END AS hidden_attr,
  CASE
    WHEN "Command" ILIKE '%+s%' THEN 1 ELSE 0
  END AS system_attr,
  CASE
    WHEN "Command" ILIKE '%Temp%'
      OR "Command" ILIKE '%AppData%'
      OR "Command" ILIKE '%ProgramData%'
      OR "Command" ILIKE '%Recycle%'
      OR "Command" ILIKE '%Windows%' THEN 1 ELSE 0
  END AS suspicious_target,
  CASE
    WHEN "Parent Process Name" ILIKE '%cmd.exe%'
      OR "Parent Process Name" ILIKE '%powershell.exe%'
      OR "Parent Process Name" ILIKE '%wscript.exe%'
      OR "Parent Process Name" ILIKE '%cscript.exe%' THEN 1 ELSE 0
  END AS suspicious_parent
FROM events
WHERE
  LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
  AND (
    QIDNAME(qid) = 'Process Create'
    OR QIDNAME(qid) LIKE '%EventID 4688%'
    OR QIDNAME(qid) LIKE '%EventID 1%'
  )
  AND "Process Name" ILIKE '%attrib.exe%'
  AND (
    "Command" ILIKE '%+h%'
    OR "Command" ILIKE '%+s%'
    OR "Command" ILIKE '%+r%'
  )
  AND starttime > NOW() - 86400000
HAVING (hidden_attr + system_attr + suspicious_target + suspicious_parent) > 1
ORDER BY starttime DESC

medium severity medium confidence

Data Sources

Windows Security Event Log (4688) Sysmon Event Log (Event ID 1) QRadar Windows DSM

Required Tables

events

False Positives

Enterprise software deployment tools (SCCM, Intune) using attrib.exe to hide deployment artifacts during staging
Anti-virus or endpoint security products marking their own directories as hidden and system-protected
Legitimate scheduled tasks or IT scripts that set attributes on backup or log directories to prevent accidental modification

Sumo Logic CSE

sql

_sourceCategory="windows/sysmon" OR _sourceCategory="windows/security"
| where EventID in ("1", "4688")
| where Image matches "*\\attrib.exe" OR process_name matches "*\\attrib.exe"
| where CommandLine matches "+h" OR CommandLine matches "+s" OR CommandLine matches "+r"
| eval HiddenAttr = if(CommandLine matches "*+h*", 1, 0)
| eval SystemAttr = if(CommandLine matches "*+s*", 1, 0)
| eval SuspiciousTarget = if(
    CommandLine matches "*Temp*"
    OR CommandLine matches "*AppData*"
    OR CommandLine matches "*ProgramData*"
    OR CommandLine matches "*Recycle*"
    OR CommandLine matches "*Windows*", 1, 0)
| eval SuspiciousParent = if(
    ParentImage matches "*cmd.exe*"
    OR ParentImage matches "*powershell.exe*"
    OR ParentImage matches "*wscript.exe*"
    OR ParentImage matches "*cscript.exe*", 1, 0)
| eval RiskScore = HiddenAttr + SystemAttr + SuspiciousTarget + SuspiciousParent
| where RiskScore > 1
| fields _messageTime, Computer, User, CommandLine, ParentImage, HiddenAttr, SystemAttr, SuspiciousTarget, SuspiciousParent, RiskScore
| sort by _messageTime desc

medium severity medium confidence

Data Sources

Sysmon (Event ID 1) Windows Security (Event ID 4688) Sumo Logic Windows App

Required Tables

windows/sysmon windows/security

False Positives

Application installers (e.g., Adobe, Microsoft Office) hiding licensing or activation files in AppData or ProgramData during installation
IT management agents (e.g., SolarWinds, ManageEngine) setting hidden attributes on their working directories
Developer tools or IDEs caching build artifacts in hidden directories under AppData or Temp

Google Chronicle / SecOps

yaral

rule t1564_001_hidden_files_attrib {
  meta:
    author = "Argus Detection Engineering"
    description = "Detects attrib.exe used to set hidden (+h), system (+s), or read-only (+r) attributes, especially targeting suspicious paths or launched from script interpreters — indicative of T1564.001 Hide Artifacts: Hidden Files and Directories"
    mitre_attack_tactic = "Defense Evasion"
    mitre_attack_technique = "T1564.001"
    severity = "MEDIUM"
    confidence = "HIGH"
    version = "1.0"
    created = "2026-04-21"

  events:
    $e.metadata.event_type = "PROCESS_LAUNCH"
    $e.principal.process.file.full_path = /attrib\.exe$/i
    (
      $e.principal.process.command_line = /\+h/i or
      $e.principal.process.command_line = /\+s/i or
      $e.principal.process.command_line = /\+r/i
    )
    (
      $e.principal.process.command_line = /(Temp|AppData|ProgramData|Recycle|Windows)/i or
      $e.principal.process.parent_process.file.full_path = /(cmd|powershell|wscript|cscript|mshta)\.exe$/i
    )
    $e.principal.hostname = $hostname

  condition:
    $e
}

medium severity high confidence

Data Sources

Google Chronicle UDM Windows Sysmon (via Chronicle forwarder) Microsoft Defender for Endpoint (via Chronicle)

Required Tables

UDM Events (PROCESS_LAUNCH)

False Positives

Group Policy or logon scripts executed by cmd.exe that set hidden attributes on roaming profile cache directories
Legitimate antivirus software quarantine routines that use attrib.exe to hide quarantined file copies
Windows system processes like TrustedInstaller managing hidden system files during patching or update operations

CrowdStrike LogScale (CQL)

cql

#event_simpleName=ProcessRollup2
| ImageFileName = /attrib\.exe$/i
| CommandLine = /\+[hHsS]/
| eval HiddenAttr = if(CommandLine = /\+h/i, 1, 0)
| eval SystemAttr = if(CommandLine = /\+s/i, 1, 0)
| eval SuspiciousTarget = if(CommandLine = /(Temp|AppData|ProgramData|Recycle|Windows)/i, 1, 0)
| eval SuspiciousParent = if(ParentBaseFileName = /(cmd|powershell|wscript|cscript|mshta)\.exe$/i, 1, 0)
| eval RiskScore = HiddenAttr + SystemAttr + SuspiciousTarget + SuspiciousParent
| RiskScore > 1
| groupBy([ComputerName, UserName, CommandLine, ParentBaseFileName], function=[
    max(RiskScore, as=MaxRisk),
    max(HiddenAttr, as=HiddenAttr),
    max(SystemAttr, as=SystemAttr),
    max(SuspiciousTarget, as=SuspiciousTarget),
    max(SuspiciousParent, as=SuspiciousParent),
    count(as=EventCount)
  ])
| sort(MaxRisk, order=desc)

medium severity high confidence

Data Sources

CrowdStrike Falcon EDR Falcon ProcessRollup2 events

Required Tables

ProcessRollup2

False Positives

Endpoint management tools or deployment scripts setting hidden attributes on agent working directories to protect operational files
Third-party backup clients hiding their local cache directories using attrib.exe as part of a normal install routine
Developer environment setup scripts (e.g., dotfile bootstrap scripts, WSL configuration) that mark configuration directories as hidden

Hidden Files and Directories

Data Sources

Required Tables

False Positives

Data Sources

Required Sourcetypes

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Data Sources

Required Tables

False Positives

Response Playbook

Investigation Guide

Atomic Red Team Tests

Unlock Pro Content

Related Detections

Parent Technique

Related Sub-techniques

Same Tactic: Defense Evasion

Popular Detections