(SIGMA) SIGMA_hide_copy_melt

June 20, 2022, midnight | 2 weeks, 2 days
            title: Hide copy and delete itself
status: experimental
description: Hide copy via attrib.exe and delete itself
author: Joe Security
date: 2019-11-12
id: 200025
threatname:
behaviorgroup: 1
classification: 8
mitreattack: 

logsource:
      category: process_creation
      product: windows
detection:
      selection:      
          CommandLine:
              - '*attrib +s +h *timeout /t *del /f /q*'
      condition: selection
level: critical
        

Associated Techniques

Technique Name Technique ID's Has Snippet(s)
File Melt U1007

Comment