T1564 Hide Artifacts
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- Exports Registry Key To an Alternate Data Streamhightest · windows
- File Download with Headless Browserhightest · windows
- HackTool - Covenant PowerShell Launcherhightest · windows
- HackTool Named File Stream Createdhightest · windows
- Hiding User Account Via SpecialAccounts Registry Keyhightest · windows
- NTFS Alternate Data Streamhightest · windows
- Potential Data Stealing Via Chromium Headless Debugginghightest · windows
- Potential Rundll32 Execution With DLL Stored In ADShightest · windows
- Potentially Suspicious Execution From Parent Process In Public Folderhightest · windows
- PowerShell Logging Disabled Via Registry Key Tamperinghightest · windows
- PrintBrm ZIP Creation of Extractionhightest · windows
- Registry Persistence via Service in Safe Modehightest · windows
- Run PowerShell Script from ADShightest · windows
- Set Suspicious Files as System Files Using Attrib.EXEhightest · windows
- Suspicious Creation with Colorcplhightest · windows
- Suspicious Executable File Creationhightest · windows
- Suspicious File Download From File Sharing Websites - File Streamhightest · windows
- Sysmon Configuration Errorhightest · windows
- Sysmon Configuration Modificationhightest · windows
- Unusual File Download from Direct IP Addresshightest · windows
- Atomic MacOS Stealer - Persistence Indicatorshighexperimental · macos
- CrashControl CrashDump Disabledmediumtest · windows
- Displaying Hidden Files Feature Disabledmediumtest · windows
- Execute From Alternate Data Streamsmediumtest · windows
- Hidden Executable In NTFS Alternate Data Streammediumtest · windows
Showing 25 of 49.
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.