attrib is a Windows command for viewing and changing file attributes such as hidden, system and read-only. Attackers use it to conceal tools, alter files and reduce visibility during persistence or staging. Defenders should inspect unusual attribute changes, especially on user-writable paths and startup locations.
What attrib does in Windows
attrib is a built-in Windows utility for viewing and changing file attributes such as hidden, system, and read-only. It is legitimate administration tooling, but it is also a common dual-use command because the same attribute changes can suppress visibility and interfere with normal file handling.
Why attackers abuse attrib
Adversaries use attrib to make malicious files harder to notice, especially when they want tools to blend into crowded directories or stay out of casual review. That makes it a classic living-off-the-land technique, and NHIMG’s Living off the Land Guide covers how Windows native utilities such as attrib are abused and hunted.
On its own, attrib does not create persistence, but it can help conceal the files that persistence depends on, such as scripts, droppers, or staged payloads. It is especially concerning when file attributes change in locations that should usually be transparent, like user-writable paths, startup folders, and staging directories.
How defenders interpret suspicious attribute changes
Defenders should treat unexpected hidden, system, or read-only changes as a visibility signal, not proof of compromise by itself. The useful question is whether the attribute change matches an expected admin workflow, software installation, or packaging process, or whether it appears alongside other signs of staging, execution, or tampering.
Attribute changes become more meaningful when they cluster around scripts, archives, shortcut targets, autorun locations, or recently written files. In practice, the strongest review pattern is to compare the attribute event with surrounding process activity, parent command lines, and file creation history.
What good response looks like
Response usually focuses on scope and context, not just the command itself. If attrib was used to obscure content during intrusion activity, defenders should identify the affected files, determine whether the hidden or protected items were executed or modified, and review adjacent systems for the same pattern of concealment.
Windows file attribute abuse is often a small part of a larger tradecraft chain, so analysis should connect it to surrounding execution and detection evidence rather than treating it as an isolated event. MITRE ATT&CK is a useful reference for mapping this kind of behavior to broader adversary technique patterns, and the MITRE ATT&CK Enterprise Matrix helps place attrib-like activity into a wider detection and response workflow.
Risk and Threat Considerations
attrib is risky because it can reduce human visibility without changing the underlying file contents, which makes it useful for concealment during staging, persistence, and post-compromise cleanup. The danger is not the attribute change alone, but the way it helps malicious tooling hide in plain sight on endpoints and shared writeable locations.
Failure mechanism: an attacker sets hidden or system attributes on malicious files, then relies on operators and casual browsing tools to overlook them while the files remain available to the malware chain.
Impact: defenders may miss staging artifacts, delayed execution paths, or persistence components, which increases dwell time and makes cleanup less reliable.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while CIS Controls v8 and NIST SP 800-53 Rev 5 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1564.001 — Hidden Files and Directories | attrib directly changes file visibility by hiding files and folders |
| Recommendation — Correlate hidden-file activity with execution, staging, and persistence telemetry. | ||
| CIS Controls v8 | CIS-10 — Malware Defenses | attrib abuse is part of malware concealment and staging behavior |
| Recommendation — Detect and block suspicious file-attribute tampering on endpoints. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | attribute changes are security-relevant endpoint events that should be logged |
| SI-4 — System Monitoring | monitoring is needed to spot concealment and staging activity tied to attrib | |
| CM-5 — Access Restrictions for Change | attrib can alter file state in ways that should be restricted on managed systems | |
| Recommendation — Log file-attribute changes and review them alongside process creation records. Monitor for suspicious hidden, system, and read-only attribute changes on sensitive paths. Restrict who can change protected file attributes on critical endpoints. | ||
Practitioner Guidance
What to watch for: investigate attribute changes that do not fit a normal software install, user workflow, or backup process. Changes on startup paths, temp folders, downloads, and other user-writable locations deserve extra attention because they often accompany concealment or staging.
Practitioner takeaway: attrib matters less as a standalone command than as a signal that file visibility has been intentionally manipulated. Treat it as a hunt lead and confirm it against process, path, and execution context before closing the case.