Detects usage of attrib.exe to hide files from users.

Detects the execution of "attrib" with the "+s" flag to mark files as system files

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Detects modifications to the hidden files keys in registry. This technique is abused by several malware families to hide their files from normal users.

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.