{"id":"T1564.001","name":"Hidden Files and Directories","url":"https://attack.mitre.org/techniques/T1564/001","tactics":["stealth"],"platforms":["Linux","macOS","Windows"],"live":true,"revoked":false,"deprecated":false,"revoked_by":null,"detection_strategies":[{"id":"DET0032","stix_id":"x-mitre-detection-strategy--3f59957a-2e55-4378-bbe7-090fb1e4f067","name":"Detection Strategy for Hidden Files and Directories","url":"https://attack.mitre.org/detectionstrategies/DET0032","analytics":[{"id":"AN0091","stix_id":"x-mitre-analytic--4ea80ec4-bfcc-4bd6-b986-aa2c9fe2d8d6","name":"Analytic 0091","description":"Suspicious use of attrib.exe or PowerShell commands to set hidden attributes on files/directories. Defender view: processes modifying file attributes to 'hidden' or creating files with ADS (alternate data streams).","url":"https://attack.mitre.org/detectionstrategies/DET0032#AN0091","platforms":["Windows"],"log_source_references":[{"name":"WinEventLog:Sysmon","channel":"EventCode=1","data_component":"DC0032","data_component_name":"Process Creation","log_source_slug":"wineventlog-sysmon"},{"name":"WinEventLog:Sysmon","channel":"EventCode=11","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"wineventlog-sysmon"}],"mutable_elements":[{"field":"MonitoredExtensions","description":"Filter hidden file detection by sensitive file extensions (.exe, .dll, .bat)."},{"field":"ADSMonitoring","description":"Enable detection of alternate data streams depending on organizational usage."}],"live":true,"detection_strategies":["DET0032"],"techniques":["T1564.001"]},{"id":"AN0092","stix_id":"x-mitre-analytic--c4108797-7eb4-4ef8-8dee-c2db00695ab4","name":"Analytic 0092","description":"Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.","url":"https://attack.mitre.org/detectionstrategies/DET0032#AN0092","platforms":["Linux"],"log_source_references":[{"name":"auditd:FILE","channel":"File creation with name starting with '.'","data_component":"DC0039","data_component_name":"File Creation","log_source_slug":"auditd-file"},{"name":"auditd:EXECVE","channel":"Use of mv or cp to rename files with '.' prefix","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"auditd-execve"}],"mutable_elements":[{"field":"DirectoryScope","description":"Restrict detection to critical directories to avoid noise from benign hidden files like .ssh or .config."}],"live":true,"detection_strategies":["DET0032"],"techniques":["T1564.001"]},{"id":"AN0093","stix_id":"x-mitre-analytic--73931643-7fae-409c-98b3-00bd88e246e0","name":"Analytic 0093","description":"Use of chflags hidden or SetFile -a V commands to hide files, or creation of hidden files with leading '.'. Defender view: monitoring process execution and file metadata changes setting UF_HIDDEN attribute.","url":"https://attack.mitre.org/detectionstrategies/DET0032#AN0093","platforms":["macOS"],"log_source_references":[{"name":"macos:unifiedlog","channel":"Execution of chflags hidden or SetFile -a V","data_component":"DC0064","data_component_name":"Command Execution","log_source_slug":"macos-unifiedlog"},{"name":"macos:unifiedlog","channel":"File metadata updated with UF_HIDDEN flag","data_component":"DC0059","data_component_name":"File Metadata","log_source_slug":"macos-unifiedlog"}],"mutable_elements":[{"field":"HiddenAttributeScope","description":"Restrict detection to non-standard directories where hidden flags are unexpected."}],"live":true,"detection_strategies":["DET0032"],"techniques":["T1564.001"]}],"live":true,"version":"1.0","techniques":["T1564.001"]}],"sigma_rules":[{"id":"1547e27c-3974-43e2-a7d7-7f484fb928ec","title":"Registry Persistence via Service in Safe Mode","author":"frack113","status":"test","level":"high","date":"2022-04-04","modified":"2025-10-22","description":"Detects the modification of the registry to allow a driver or service to persist in Safe Mode.","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-33---windows-add-registry-value-to-load-service-in-safe-mode-without-network","https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-34---windows-add-registry-value-to-load-service-in-safe-mode-with-network"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/windows/registry/registry_set/registry_set_add_load_service_in_safe_mode.yml","techniques":["T1564.001"],"cves":[]},{"id":"4281cb20-2994-4580-aa63-c8b86d019934","title":"Hiding Files with Attrib.exe","author":"Sami Ruohonen","status":"test","level":"medium","date":"2019-01-16","modified":"2023-03-14","description":"Detects usage of attrib.exe to hide files from users.","references":["https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/","https://www.uptycs.com/blog/lolbins-are-no-laughing-matter"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/windows/process_creation/proc_creation_win_attrib_hiding_files.yml","techniques":["T1564.001"],"cves":[]},{"id":"4ae81040-fc1c-4249-bfa3-938d260214d9","title":"Use Icacls to Hide File to Everyone","author":"frack113","status":"test","level":"medium","date":"2022-07-18","modified":"2024-04-29","description":"Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files","references":["https://app.any.run/tasks/1df999e6-1cb8-45e3-8b61-499d1b7d5a9b/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/windows/process_creation/proc_creation_win_icacls_deny.yml","techniques":["T1564.001"],"cves":[]},{"id":"5a5152f1-463f-436b-b2f5-8eceb3964b42","title":"Displaying Hidden Files Feature Disabled","author":"frack113","status":"test","level":"medium","date":"2022-04-02","modified":"2024-03-26","description":"Detects modifications to the \"Hidden\" and \"ShowSuperHidden\" explorer registry values in order to disable showing of hidden files and system files.\nThis technique is abused by several malware families to hide their files from normal users.\n","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-8---hide-files-through-registry"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/windows/registry/registry_set/registry_set_hide_file.yml","techniques":["T1564.001"],"cves":[]},{"id":"bb19e94c-59ae-4c15-8c12-c563d23fe52b","title":"Set Files as System Files Using Attrib.EXE","author":"frack113","status":"test","level":"low","date":"2022-02-04","modified":"2023-03-14","description":"Detects the execution of \"attrib\" with the \"+s\" flag to mark files as system files","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md#atomic-test-3---create-windows-system-file-with-attrib","https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib","https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.001","detection.threat-hunting"],"path":"rules-threat-hunting/windows/process_creation/proc_creation_win_attrib_system.yml","techniques":["T1564.001"],"cves":[]},{"id":"d08722cd-3d09-449a-80b4-83ea2d9d4616","title":"Hidden Files and Directories","author":"Pawel Mazur","status":"test","level":"low","date":"2021-09-06","modified":"2025-06-16","description":"Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md"],"logsource":{"product":"linux","service":"auditd"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/linux/auditd/execve/lnx_auditd_hidden_files_directories.yml","techniques":["T1564.001"],"cves":[]},{"id":"e710a880-1f18-4417-b6a0-b5afdf7e3023","title":"Atomic MacOS Stealer - Persistence Indicators","author":"Jason Phang Vern - Onn, Robbin Ooi Zhen Heng (Gen Digital)","status":"experimental","level":"high","date":"2025-11-22","modified":null,"description":"Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.\n","references":["https://moonlock.com/amos-backdoor-persistent-access","https://github.com/bobby-tablez/TTP-Threat-Feeds/blob/45398914e631f8372c3a9fbcd339ff65ffff1b17/results/2025/10/20251001-161956-trendmicro-atomic-macos-stealer-(amos).yml#L44"],"logsource":{"product":"macos","category":"file_event"},"tags":["attack.persistence","attack.privilege-escalation","attack.stealth","attack.t1564.001","attack.t1543.004","detection.emerging-threats"],"path":"rules-emerging-threats/2025/Malware/Atomic-MacOS-Stealer/file_event_macos_malware_amos_persistence.yml","techniques":["T1564.001","T1543.004"],"cves":[]},{"id":"efec536f-72e8-4656-8960-5e85d091345b","title":"Set Suspicious Files as System Files Using Attrib.EXE","author":"Nasreddine Bencherchali (Nextron Systems)","status":"test","level":"high","date":"2022-06-28","modified":"2023-03-14","description":"Detects the usage of attrib with the \"+s\" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs\n","references":["https://app.any.run/tasks/c28cabc8-a19f-40f3-a78b-cae506a5c0d4","https://app.any.run/tasks/cfc8870b-ccd7-4210-88cf-a8087476a6d0","https://unit42.paloaltonetworks.com/unit42-sure-ill-take-new-combojack-malware-alters-clipboards-steal-cryptocurrency/"],"logsource":{"product":"windows","category":"process_creation"},"tags":["attack.stealth","attack.t1564.001"],"path":"rules/windows/process_creation/proc_creation_win_attrib_system_susp_paths.yml","techniques":["T1564.001"],"cves":[]},{"id":"fecfd1a1-cc78-4313-a1ea-2ee2e8ec27a7","title":"PowerShell Logging Disabled Via Registry Key Tampering","author":"frack113","status":"test","level":"high","date":"2022-04-02","modified":"2023-08-17","description":"Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging","references":["https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1112/T1112.md#atomic-test-32---windows-powershell-logging-disabled"],"logsource":{"product":"windows","category":"registry_set"},"tags":["attack.stealth","attack.defense-impairment","attack.t1564.001","attack.t1112","attack.persistence"],"path":"rules/windows/registry/registry_set/registry_set_powershell_logging_disabled.yml","techniques":["T1564.001","T1112"],"cves":[]}],"kev_cves":[],"_built":"2026-08-23 05:47 UTC","_attack_version":"19.2","_sigma_commit":"da9bb07d642a2826e89702445d32c795209ec108"}