AN1384
Analytic 1384
Windows
Abuse of file/registry attributes to hide malicious files, directories, or services. Defender view: detection of attrib.exe setting hidden/system flags, creation of Alternate Data Streams, or registry keys altering file visibility.
WinEventLog:Sysmon
EventCode=11
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=13, 14
[FileExtensions]
Filter for sensitive file types likely targeted for hiding.
[ADSDetection]
Enable or disable detection of Alternate Data Streams depending on business use.
AN1385
Analytic 1385
Linux
Hidden file creation using leading '.' or file attribute changes with chattr (immutable/hidden flags). Defender view: detect execution of chattr, lsattr anomalies, and unusual hidden files appearing in system directories.
auditd:EXECVE
Execution of chattr to set +i or +a attributes
auditd:FILE
Creation of hidden files (.*) in sensitive directories (/etc, /var, /usr/bin)
[DirectoryScope]
Restrict hidden file detection to privileged system directories.
[AttributeFlags]
Tune for specific chattr flags (+i immutable, +a append-only) most abused for persistence.
AN1386
Analytic 1386
macOS
Hidden files via 'chflags hidden' or Apple-specific attributes, LaunchAgents/LaunchDaemons placed in non-standard hidden directories. Defender view: detect command execution modifying file flags and unusual plist creation in hidden paths.
macos:unifiedlog
Execution of chflags hidden or setfile -a V
macos:unifiedlog
Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories
[HiddenDirectories]
List of directories monitored for hidden plist or agent placement.
AN1387
Analytic 1387
ESXi
Abuse of VMFS or ESXi shell to hide datastore files, renaming/moving VMDK or VMX files into hidden directories. Defender view: anomalous ESXi shell commands or file operations obscuring VM artifacts.
esxi:shell
mv, rename, or chmod commands moving VM files into hidden directories
esxi:syslog
Datastore file hidden or renamed unexpectedly
[VMFileScope]
Restrict to VMDK, VMX, or log files critical for VM operations.
AN1388
Analytic 1388
Office Suite
Malicious macros or embedded objects hidden within Office documents by renaming streams or using hidden OLE objects. Defender view: detection of hidden macro streams or objects in documents correlated with anomalous execution.
m365:unified
Detection of hidden macro streams or SetHiddenAttribute actions
[MacroScope]
Tune detection to specific Office apps and document types where macros are disallowed.