MITRE ATT&CKtechnique

T1083 File and Directory Discovery

Published 2017-05-31 Modified 2026-09-11 Official page ↗
Domain
enterprise
Tactics
Discovery
Platforms
ESXi, Linux, macOS, Network Devices, Windows
Version
1.7
Created
2017-05-31

Description

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram). Some files and directories may require elevated or specific user permissions to access.

Related

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (381)

  • S9063 DEEPROOT software (malware)
  • S9067 TWOSTROKE software (malware)
  • S9059 MiniBike software (malware)
  • S9052 MiniFast software (malware)
  • S9053 MiniJunk software (malware)
  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • C0064 AI-Assisted Breach of Mexico's Government Infrastructure campaign
  • G1057 ShinyHunters group
  • S9043 Mini Shai-Hulud software (malware)
  • S9042 CanisterWorm software (malware)
  • S9041 TeamPCP Cloud Stealer software (malware)
  • C0063 2025 Poland Wiper Attacks campaign
  • S9038 DynoWiper software (malware)
  • S9039 LazyWiper software (malware)
  • S9035 LAMEHUG software (malware)
  • C0062 Anthropic AI-orchestrated Campaign campaign
  • S9030 SameCoin software (malware)
  • S9031 AshTag software (malware)
  • S9027 ANELLDR software (malware)
  • C0060 Operation AkaiRyū campaign
  • G1054 MirrorFace group
  • S9020 LODEINFO software (malware)
  • S9015 BRICKSTORM software (malware)
  • S9009 TruffleHog software (tool)
  • S9002 Diskpart software (tool)
  • C0059 Salesforce Data Exfiltration campaign
  • G1052 Contagious Interview group
  • S1246 BeaverTail software (malware)
  • S1247 Embargo software (malware)
Show all 381 ›

Referenced by CAPEC · att&ck technique (2)

References