Hiding Files with Attrib.exe
This rule detects the use of the `attrib.exe` utility to hide files by setting the hidden attribute (`+h`). Adversaries often use this technique to conceal malicious files or directories from users and basic forensic analysis, aiding in defense evasion. The rule specifically looks for the execution of `attrib.exe` with the `+h` command-line argument.
Sigma
