Threaticon
Toggle sidebar

You're viewing a limited, public preview. Log in for full access.

Log in User Guide
Log in Get started
Detection Strategies DET0032 — Detection Strategy for Hidden Files and Directories
DET0032

Detection Strategy for Hidden Files and Directories

3 analytic(s) · 1 technique(s) detected

Analytics

3
AN0091 Analytic 0091
Windows

Suspicious use of attrib.exe or PowerShell commands to set hidden attributes on files/directories. Defender view: processes modifying file attributes to 'hidden' or creating files with ADS (alternate data streams).

WinEventLog:Sysmon EventCode=1 WinEventLog:Sysmon EventCode=11
[MonitoredExtensions] Filter hidden file detection by sensitive file extensions (.exe, .dll, .bat).
[ADSMonitoring] Enable detection of alternate data streams depending on organizational usage.
AN0092 Analytic 0092
Linux

Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.

auditd:FILE File creation with name starting with '.' auditd:EXECVE Use of mv or cp to rename files with '.' prefix
[DirectoryScope] Restrict detection to critical directories to avoid noise from benign hidden files like .ssh or .config.
AN0093 Analytic 0093
macOS

Use of chflags hidden or SetFile -a V commands to hide files, or creation of hidden files with leading '.'. Defender view: monitoring process execution and file metadata changes setting UF_HIDDEN attribute.

macos:unifiedlog Execution of chflags hidden or SetFile -a V macos:unifiedlog File metadata updated with UF_HIDDEN flag
[HiddenAttributeScope] Restrict detection to non-standard directories where hidden flags are unexpected.

Detected Techniques

1

Details

MITRE ID
DET0032
STIX ID
x-mitre-detection-strategy--3f59957a-2e55-4378-bbe7-090fb1e4f067
Analytics
3
Techniques Detected
1
By Tactic
Stealth
1
Leaving Threaticon

This link opens an external site that isn't part of the platform.