Hide Artifacts: Hidden Files and Directories T1564.001
Tactic: Stealth
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
Events covered
8 catalog events are tagged with this technique by at least one rule.
| Provider | Event | Title |
|---|---|---|
| Sysmon | Event ID 1 | Process creation |
| Sysmon | Event ID 11 | FileCreate |
| Sysmon | Event ID 13 | RegistryEvent (Value Set) |
| Security-Auditing | Event ID 4688 | A new process has been created. |
| Event ID 0 | Event ID 0 | |
| ESF | exec | Process Execution (Notify) |
| ESF | create | File or Directory Create (NOTIFY) |
| Linux-Auditd | Event ID 1309 | EXECVE |
Authoring guide
Patterns shared across the 28 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.
Fields filtered most (31 distinct)
The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.
Top indicator values (236 distinct)
Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.
Exclusions (110 distinct)
Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.
Rules under this technique
Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.
Sigma 10 rules
- Atomic MacOS Stealer - Persistence Indicators
- Displaying Hidden Files Feature Disabled
- Hidden Files and Directories
- Hiding Files with Attrib.exe
- macOS ESF Rename To Hidden Dotfile
- PowerShell Logging Disabled Via Registry Key Tampering
- Registry Persistence via Service in Safe Mode
- Set Files as System Files Using Attrib.EXE
- Set Suspicious Files as System Files Using Attrib.EXE
- Use Icacls to Hide File to Everyone
Elastic 16 rules
- Adding Hidden File Attribute via Attrib
- Creation of Hidden Files and Directories via CommandLine
- Creation of Hidden Launch Agent or Daemon
- Creation of Hidden Shared Object File
- Directory Creation in /bin directory
- File Creation in /var/log via Suspicious Process
- File Staged in Root Folder of Recycle Bin
- Hidden Directory Creation via Unusual Parent
- Hidden Files and Directories via Hidden Flag
- High Number of Egress Network Connections from Unusual Executable
- Kill Command Execution
- Persistence via a Hidden Plist Filename
- Potential Hidden Process via Mount Hidepid
- Potential Kubectl Masquerading via Unexpected Process
- Suspicious Hidden Child Process of Launchd
- Suspicious Process Execution Detected via Defend for Containers