MITRE ATT&CKsub-technique

T1564.001 Hidden Files and Directories

Published 2020-02-26 Modified 2026-05-12 Official page ↗
Domain
enterprise
Tactics
Stealth
Platforms
Linux, macOS, Windows
Version
2.0
Created
2020-02-26

Description

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS). On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name . Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app . On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character. Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.

Related

Subtechnique of · MITRE ATT&CK (1)

  • T1564 Hide Artifacts technique

Tactic · MITRE ATT&CK (1)

Referenced by MITRE ATT&CK · uses (62)

  • S9051 The Gentlemen Ransomware software (malware)
  • S9050 Vidar software (malware)
  • G1056 TeamPCP group
  • S9041 TeamPCP Cloud Stealer software (malware)
  • S1236 CLAIMLOADER software (malware)
  • S1230 HIUPAN software (malware)
  • S1219 REPTILE software (malware)
  • C0047 RedDelta Modified PlugX Infection Chain Operations campaign
  • S1176 attrib software (tool)
  • G1039 RedCurl group
  • S1153 Cuckoo Stealer software (malware)
  • S1111 DarkGate software (malware)
  • S1105 COATHANGER software (malware)
  • G1016 FIN13 group
  • G1014 LuminousMoth group
  • S1043 ccf32 software (malware)
  • S0663 SysUpdate software (malware)
  • S0660 Clambling software (malware)
  • S0658 XCSSET software (malware)
  • S0650 QakBot software (malware)
  • G0134 Transparent Tribe group
  • S0634 EnvyScout software (malware)
  • S0612 WastedLocker software (malware)
  • G0129 Mustang Panda group
  • S0595 ThiefQuest software (malware)
  • G0125 HAFNIUM group
  • S0584 AppleJeus software (malware)
  • S0569 Explosive software (malware)
  • S0533 SLOTHFULMEDIA software (malware)
  • S0497 Dacls software (malware)
Show all 62 ›

References