AN0091
Analytic 0091
Windows
Suspicious use of attrib.exe or PowerShell commands to set hidden attributes on files/directories. Defender view: processes modifying file attributes to 'hidden' or creating files with ADS (alternate data streams).
WinEventLog:Sysmon
EventCode=1
WinEventLog:Sysmon
EventCode=11
[MonitoredExtensions]
Filter hidden file detection by sensitive file extensions (.exe, .dll, .bat).
[ADSMonitoring]
Enable detection of alternate data streams depending on organizational usage.
AN0092
Analytic 0092
Linux
Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.
auditd:FILE
File creation with name starting with '.'
auditd:EXECVE
Use of mv or cp to rename files with '.' prefix
[DirectoryScope]
Restrict detection to critical directories to avoid noise from benign hidden files like .ssh or .config.
AN0093
Analytic 0093
macOS
Use of chflags hidden or SetFile -a V commands to hide files, or creation of hidden files with leading '.'. Defender view: monitoring process execution and file metadata changes setting UF_HIDDEN attribute.
macos:unifiedlog
Execution of chflags hidden or SetFile -a V
macos:unifiedlog
File metadata updated with UF_HIDDEN flag
[HiddenAttributeScope]
Restrict detection to non-standard directories where hidden flags are unexpected.