T1564.001 Hidden Files and Directories - attrib/icacls Deny in SMB Traffic

Ankit Mehta@Secvyn

•updated Jun 30, 2026•0•0•2

Detects SMB traffic patterns containing commands indicative of file obfuscation or permission tampering, specifically the use of 'attrib' to set hidden or system attributes, 'icacls' to deny access to files, or PowerShell execution with the '-WindowStyle Hidden' argument.