T1564.001 Hidden Files and Directories
Sub-technique of T1564 Hide Artifacts
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files…
Who uses it · with stories on Jábega
Sigma rules to hunt it
- PowerShell Logging Disabled Via Registry Key Tamperinghightest · windows
- Registry Persistence via Service in Safe Modehightest · windows
- Set Suspicious Files as System Files Using Attrib.EXEhightest · windows
- Atomic MacOS Stealer - Persistence Indicatorshighexperimental · macos
- Displaying Hidden Files Feature Disabledmediumtest · windows
- Hiding Files with Attrib.exemediumtest · windows
- Use Icacls to Hide File to Everyonemediumtest · windows
Rules from SigmaHQ · Detection Rule License 1.1. Technique from MITRE ATT&CK®.