Process Hollowing of attrib.exe via Suspicious Loader Injection

Ibrahim Saud@tektrix

•updated 12 days ago•0•0•2

Detects instances where attrib.exe is executed with minimal or no command-line arguments, launched by processes other than standard Windows shell processes like cmd.exe, explorer.exe, or powershell.exe. This pattern is often indicative of potential masquerading, where malicious binaries are renamed to mimic legitimate Windows system utilities to evade detection.