Hide Artifacts T1564

Tactic: Stealth

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.

Events covered

25 catalog events are tagged with this technique by at least one rule.

Authoring guide

Patterns shared across the 138 rules above: which fields they filter on, what specific values they look for, and what they exclude. The catalog normalizes field names across vendors so Sigma's Image, Elastic's process.name, and Splunk's process_name collapse into one row. Each rule contributes at most once per row.

Fields filtered most (84 distinct)

The fields most rules look at when detecting this technique. The How column shows the operators authors use (eq, wildcard, regex_match, match) and how often each appears. Sample values are concrete examples to start from, not an exhaustive list.

FieldRulesHowSample values
CommandLine55contains 40, regex_match 13, match 5, ends_with 1, eq 1, in 1, is_not_null 1, wildcard 1--headless, (?i)\.cab|(-|\/)F:|\x5cAppData\x5c|(Local|Roaming)\x5cTemp\x5c, attrib.+?\.dll, (?i)(\s+ADD\s+.*\/d.*0), (?i)(esentutl|\.exe)\"?\s.*\/y\s.*\/d\s
Image35ends_with 28, contains 5, starts_with 4, eq 2, is_not_null 1, match 1, wildcard 1/dev/shm/, \attrib.exe, ./, /boot/, /media/
process_name30eq 13, in 7, starts_with 6, match 2, wildcard 2., sc.exe, (?i)expand\.exe, bash, cp
event.type28eq 24, in 3, ne 1start, creation, change, process_started, deletion
host.os.type22eq 21, in 1
EventType21in 11, eq 10exec, exec_event, ProcessRollup2, New-InboxRule, Set-InboxRule
EventID17eq 174688, 1, 4103, 4104, 15
OriginalFileName17eq 17attrib.exe, sc.exe, findstr.exe, advancedrun.exe, cmd.exe
TargetFilename15contains 5, ends_with 3, starts_with 3, regex_match 2, wildcard 2, eq 1, match 1(?<!\/)\b\w+(\.\w+)?:\w+(\.\w+)?$, .bat:zone, .cmd:zone, .dll:zone, .bat.exe
process.args13eq 7, wildcard 5, contains 2, starts_with 2, ends_with 1, match 1-c, /*/.*, /bin/, &, *--as *
ParentImage11ends_with 6, eq 3, is_not_null 3, contains 2, starts_with 2\thor\thor64.exe, \webex\webexhost.exe, /boot/, /dev/shm/, /opt/.
Details8eq 7, is_not_null 1, length_compare 1DWORD (0x00000000), 0, 0x00000000, 0x00000001, 1
event.category8eq 7, in 1process, file, authentication
ScriptBlockText7contains 7$psscriptroot\module\workspacescriptmodule\workspacescriptmodule, -argumentlist , -filepath "$env:comspec" , -stream, :\program files\amazon\workspacesconfig\scripts\
TargetObject7contains 4, ends_with 4, wildcard 1\(default), \control\safeboot\minimal\, \control\safeboot\minimal\hexnode agent\(default), \enablescripts, \microsoft\powershellcore\

Top indicator values (1061 distinct)

Specific (field, operator, value) combinations the rules check for, ranked by how many rules under this technique use each one. The Corpus reach column counts how many rules across the entire catalog (any technique) check the same combination. High numbers point to widely-used indicators that are likely noisy on their own; combine them with another condition for useful signal. Blank means the combination is specific to rules under this technique. Click a value to expand the rules under this technique that use it.

FieldKindValueRules (here)Corpus reach
event.typeeq
start
19606
event.typeeq
creation
545
EventTypeeq
exec
7171
CommandLinecontains
--headless
68
CommandLinecontains
.cab
35
EventIDeq
4688
6313
EventIDeq
1
5237
EventIDeq
4103
3105
EventIDeq
4104
3268
EventTypein
exec
6171
EventTypein
exec_event
6139
EventTypein
start
6134
EventTypein
ProcessRollup2
3117
event.categoryeq
process
5128
process_namestarts_with
.
518
Detailseq
DWORD (0x00000000)
438
OriginalFileNameeq
attrib.exe
45
OriginalFileNameeq
sc.exe
326
ParentImageends_with
\thor\thor64.exe
4
ParentImageends_with
\webex\webexhost.exe
4
CommandLinematch
(?i)\.cab|(-|\/)F:|\x5cAppData\x5c|(Local|Roaming)\x5cTemp\x5c
33
CommandLineregex_match
attrib.+?\.dll
33
Imageends_with
\attrib.exe
35
Imagestarts_with
/dev/shm/
323
Imagestarts_with
/tmp/
325
Imagestarts_with
/var/tmp/
324
Workloadeq
Exchange
320
event.outcomeeq
success
3251
process_nameeq
sc.exe
329
sourcetypeeq
o365:management:activity
380

Exclusions (309 distinct)

Field/operator/value combinations excluded by rules under this technique (top-level not() clauses), sorted by how many rules exclude each. These are the false-positive paths the community has learned to filter out. A new rule that ignores the high-count entries here will likely fire on the same noisy paths. Click a value to expand the rules under this technique that exclude it.

FieldKindValueRules excluding
ParentImageends_with
\thor\thor64.exe
4
ParentImageends_with
\webex\webexhost.exe
4
CommandLinematch
(?i):\x5cProgramData\x5cDell\x5cUpdateService\x5cTemp\x5c
3
Imagestarts_with
/tmp/newroot/
3
ParentCommandLineeq
runc init
3
Imagecontains
\appdata\
2
Imagecontains
\temp\
2
ParentImageeq
c:\windows\system32\cleanmgr.exe
2
ParentImageeq
c:\windows\system32\dism.exe
2
ParentImagein
/bin/make
2
ParentImagein
/lib/systemd/systemd
2
ParentImagein
/usr/bin/make
2
ParentImagein
/usr/lib/systemd/systemd
2
ParentImagestarts_with
/var/lib/docker/overlay2/
2
parent_process_namein
make
2

Rules under this technique

Every rule in the catalog tagged with this technique, grouped by vendor. Click a rule title for its full predicates, exclusions, and indicators.

Platform (all)
Domain (all)

Sigma 65 rules

Elastic 34 rules

Splunk 30 rules

Kusto 6 rules

YARA-L 1 rule

Panther 2 rules