tool
attrib is a Windows utility used to display, set or remove attributes assigned to files or directories.[1]
Enterprise ATT&CK only. Any Mobile or ICS rows on the same ATT&CK page are not carried.
Reach is how much of ATT&CK this tool touches. Coverage is how well defended each thing it does is, as a median per technique rather than a total — a total would just restate the reach. Each figure is ranked against all 825 ATT&CK software entries only where that population actually spreads. Where most of the population shares one value, a percentile would rank the tie instead of the entity, so the raw value is shown and no rank is claimed.
5th percentile · 95% of 825 ATT&CK software entries have more Enterprise techniques.
6th percentile · 94% of 825 ATT&CK software entries have more tactics spanned.
61% of the population shares a single value across only 22 distinct values, so a percentile here would rank the tie, not the entity.
85% of the population shares a single value across only 8 distinct values, so a percentile here would rank the tie, not the entity.
19th percentile · 81% of 825 ATT&CK software entries have more detection rules per technique.
11 distinct rules cover the 1 technique recorded for this tool. 9 Sigma · 2 Splunk.
| Select | Title | Description | Category | Status | Event | OS | Product | MITRE ATT&CK | CVEs | Severity | Author | Created | Updated | ID | Refs |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. (...) | Emerging | experimental | file_event | macos | - | - | high | Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital) | 2025-11-22 | — | e710a880-1f18-4417-b6a0-b5afdf7e3023 | ||||
Splunk | The following analytic detects modifications to the Windows registry that disable the display of hidden files. (...) | Anomaly | stable | registry_event | windows | Sysmon | - | medium | Teoderick Contreras, Splunk, Steven Dick | 2021-03-31 | 2026-05-13 | 6f3ccfa2-91fe-11eb-8f9b-acde48001122 | |||
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-04-02 | 2024-03-26 | 5a5152f1-463f-436b-b2f5-8eceb3964b42 | ||||
Detects adversary creating hidden file or directory, by detecting directories or files with . (...) | Generic | test | process_creation | linux | Linux Auditd | - | low | Pawel Mazur | 2021-09-06 | 2025-06-16 | d08722cd-3d09-449a-80b4-83ea2d9d4616 | ||||
Detects usage of attrib.exe to hide files from users. | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | Sami Ruohonen | 2019-01-16 | 2023-03-14 | 4281cb20-2994-4580-aa63-c8b86d019934 | ||||
Splunk | The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...) | Anomaly | stable | process_creation | - | Osquery | - | medium | Raven Tait, Splunk | 2026-04-14 | 2026-05-13 | 51c43b7b-e406-45d2-9bad-5c67f07e6528 | |||
Detects changes to the registry for the currently logged-in user. (...) | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-04-02 | 2023-08-17 | fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7 | ||||
Detects the modification of the registry to allow a driver or service to persist in Safe Mode. | Generic | test | registry_set | windows | Sysmon · WinEventLog Security | - | high | frack113 | 2022-04-04 | 2025-10-22 | 1547e27c-3974-43e2-a7d7-7f484fb928ec | ||||
Detects the execution of "attrib" with the "+s" flag to mark files as system files | Hunting | test | process_creation | windows | Sysmon · WinEventLog Security | - | low | frack113 | 2022-02-04 | 2023-03-14 | bb19e94c-59ae-4c15-8c12-c563d23fe52b | ||||
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | high | Nasreddine Bencherchali (Nextron Systems) | 2022-06-28 | 2023-03-14 | efec536f-72e8-4656-8960-5e85d091345b | ||||
Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious fi (...) | Generic | test | process_creation | windows | Sysmon · WinEventLog Security | - | medium | frack113 | 2022-07-18 | 2024-04-29 | 4ae81040-fc1c-4249-bfa3-938d260214d9 |
91st percentile · 91% of 825 ATT&CK software entries have this many atomic tests per technique or fewer.
54% of the population shares a single value across only 11 distinct values, so a percentile here would rank the tie, not the entity.
17th percentile · 83% of 825 ATT&CK software entries have more mitigations per technique.
5 of 8 axes carry an honest rank on this page. Coverage medians are taken across this tool’s 1 Enterprise technique.
Technique Campaign use over its cumulative rule count.