attrib
Displays, sets, or removes attributes assigned to files or directories. Windows commands reference
On Windows 5 Sigma rules name it File attrib.exe
Windows
Displays, sets, or removes attributes assigned to files or directories. If used without parameters, attrib displays attributes of all files in the current directory.
attrib [{+|-}r] [{+|-}a] [{+|-}s] [{+|-}h] [{+|-}o] [{+|-}i] [{+|-}x] [{+|-}p] [{+|-}u] [{+|-}b] [<drive>:][<path>][<filename>] [/s [/d] [/l]]To display the attributes of a file named News86 that is located in the current directory, type
attrib news86IdentifyTo assign the Read-only attribute to the file named report.txt, type
attrib +r report.txtIdentifyTo remove the Read-only attribute from files in the public directory and its subdirectories on a disk in drive b:, type
attrib -r b:\public\*.* /sIdentify/sApplies attrib and any command-line options to matching files in the current directory and all of its subdirectories. Windows commands referenceTrips 1 Sigma rule: mediumFile or Folder Permissions Modifications by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)
To set the Archive attribute for all files on drive a:, and then clear the Archive attribute for files with the .bak extension, type
attrib +a a:*.* & attrib -a a:*.bakIdentifyShow 15 options
{+|-}rSets (+) or clears (-) the Read-only file attribute.{+|-}aSets (+) or clears (-) the Archive file attribute. This attribute set marks files that have changed since the last time they were backed up. The xcopy command uses archive attributes.{+|-}sSets (+) or clears (-) the System file attribute. If a file uses this attribute set, you must clear the attribute before you can change any other attributes for the file.{+|-}hSets (+) or clears (-) the Hidden file attribute. If a file uses this attribute set, you must clear the attribute before you can change any other attributes for the file.{+|-}oSets (+) or clears (-) the Offline file attribute.{+|-}iSets (+) or clears (-) the Not Content Indexed file attribute.{+|-}xSets (+) or clears (-) the Scrub file attribute.{+|-}pSets (+) or clears (-) the Pinned file attribute.{+|-}uSets (+) or clears (-) the Unpinned file attribute.{+|-}bSets (+) or clears (-) the SMR Blob file attribute.[<drive>:][<path>][<filename>]Specifies the location and name of the directory, file, or group of files that you want to view or change attributes.
You can use the ? and \* wildcard characters in the filename parameter to display or change the attributes for a group of files./sApplies attrib and any command-line options to matching files in the current directory and all of its subdirectories./dApplies attrib and any command-line options to directories./lApplies attrib and any command-line options to the Symbolic Link, rather than the target of the Symbolic Link./?Displays help at the command prompt.Windows
Display or change attributes of files or directories.
Display all set attributes of files in the current directory
attribIdentifyDisplay all set attributes of files in a specific directory
attrib path\to\directoryIdentifyDisplay all set attributes of files and directories in the current directory
attrib /dIdentify/dApplies attrib and any command-line options to directories. Windows commands referenceDisplay all set attributes of files in the current directory and sub-directories
attrib /sIdentify/sApplies attrib and any command-line options to matching files in the current directory and all of its subdirectories. Windows commands referenceAdd the read-only or archive or system or hidden or not content indexed attribute to files or directories
attrib +r path\to\file_or_directory1 path\to\file_or_directory2 ...IdentifyRemove a specific attribute of files or directories
attrib -r path\to\file_or_directory1 path\to\file_or_directory2 ...IdentifyTrips 1 Sigma rule: mediumFile or Folder Permissions Modifications by Jakob Weinzettl, oscd.community, Nasreddine Bencherchali (Nextron Systems)