Hide Navigation Hide TOC Set Files as System Files Using Attrib.EXE (bb19e94c-59ae-4c15-8c12-c563d23fe52b) Detects the execution of "attrib" with the "+s" flag to mark files as system files Cluster A Galaxy A Cluster B Galaxy B Level Set Files as System Files Using Attrib.EXE (bb19e94c-59ae-4c15-8c12-c563d23fe52b) Sigma-Rules Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) Attack Pattern 1 Hide Artifacts - T1564 (22905430-4901-4c2a-84f6-98243cb173f8) Attack Pattern Hidden Files and Directories - T1564.001 (ec8fc7e2-b356-455c-8db5-2e37be158e7d) Attack Pattern 2