Cross-source coverage

T1564 / ATT&CK

Hide Artifacts

182 rules · 178 families across 10 sources.

3 deprecated hidden · include

Showing atomic-IOC rules · back to the default

From MITRE ATT&CK 19.2

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.

Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.

Tactics
Stealth
Platforms
ESXi · Linux · macOS · Office Suite · Windows
Telemetry
WinEventLog:Sysmonauditd:EXECVEauditd:FILEmacos:unifiedlogesxi:shellesxi:syslogm365:unified

How MITRE says to detect it DET0502

Detection Strategy for Hidden Artifacts Across Platforms

Windows Analytic 1384

Abuse of file/registry attributes to hide malicious files, directories, or services. Defender view: detection of attrib.exe setting hidden/system flags, creation of Alternate Data Streams, or registry keys altering file visibility.

  • WinEventLog:Sysmon EventCode=11
  • WinEventLog:Sysmon EventCode=1
  • WinEventLog:Sysmon EventCode=13, 14

Linux Analytic 1385

Hidden file creation using leading '.' or file attribute changes with chattr (immutable/hidden flags). Defender view: detect execution of chattr, lsattr anomalies, and unusual hidden files appearing in system directories.

  • auditd:EXECVE Execution of chattr to set +i or +a attributes
  • auditd:FILE Creation of hidden files (.*) in sensitive directories (/etc, /var, /usr/bin)

macOS Analytic 1386

Hidden files via 'chflags hidden' or Apple-specific attributes, LaunchAgents/LaunchDaemons placed in non-standard hidden directories. Defender view: detect command execution modifying file flags and unusual plist creation in hidden paths.

  • macos:unifiedlog Execution of chflags hidden or setfile -a V
  • macos:unifiedlog Creation of LaunchAgents/LaunchDaemons in hidden or non-standard directories

ESXi Analytic 1387

Abuse of VMFS or ESXi shell to hide datastore files, renaming/moving VMDK or VMX files into hidden directories. Defender view: anomalous ESXi shell commands or file operations obscuring VM artifacts.

  • esxi:shell mv, rename, or chmod commands moving VM files into hidden directories
  • esxi:syslog Datastore file hidden or renamed unexpectedly

Office Suite Analytic 1388

Malicious macros or embedded objects hidden within Office documents by renaming streams or using hidden OLE objects. Defender view: detection of hidden macro streams or objects in documents correlated with anomalous execution.

  • m365:unified Detection of hidden macro streams or SetHiddenAttribute actions

View on attack.mitre.org ↗

Sub-techniques with coverage

Counted in the 182 above — a rule tagged a sub-technique covers this technique too.

SigmaHQ/sigma

59 rules
Detection Severity Format
Atomic MacOS Stealer - Persistence Indicators High Sigma
Exports Registry Key To an Alternate Data Stream High Sigma
File Download with Headless Browser High Sigma
HackTool - Covenant PowerShell Launcher High Sigma
HackTool Named File Stream Created High Sigma
Hiding User Account Via SpecialAccounts Registry Key High Sigma
NTFS Alternate Data Stream High Sigma
Potential Data Stealing Via Chromium Headless Debugging High Sigma
Potentially Suspicious Execution From Parent Process In Public Folder High Sigma
Potential Rundll32 Execution With DLL Stored In ADS High Sigma

+ 49 more from SigmaHQ/sigma → showing the 10 highest-severity

elastic/detection-rules

34 rules
Detection Severity Format
Creation of a Hidden Local User Account High Elastic TOML
Executable Masquerading as Kernel Process High Elastic TOML
M365 Exchange Inbox Phishing Evasion Rule Created High Elastic TOML
Persistence via a Hidden Plist Filename High Elastic TOML
Persistence via Hidden Run Key Detected High Elastic TOML
Potential Hidden Process via Mount Hidepid High Elastic TOML
Suspicious Process Execution Detected via Defend for Containers High Elastic TOML
Unusual File Creation - Alternate Data Stream High Elastic TOML
Alternate Data Stream Creation/Execution at Volume Root Directory Medium Elastic TOML
Creation of Hidden Launch Agent or Daemon Medium Elastic TOML

+ 24 more from elastic/detection-rules → showing the 10 highest-severity

elastic/protections-artifacts

32 rules
Detection Severity Format
API Call from Inaccessible Memory Page Undefined Elastic TOML
Attempt to Hide Files via Registry Modification Undefined Elastic TOML
Background Task Execution via a Hidden Process Undefined Elastic TOML
Browser Process Started in a Hidden Desktop Undefined Elastic TOML
Creation of Hidden Shared Object File Undefined Elastic TOML
Defense Evasion via Bind Mount Undefined Elastic TOML
Defense Evasion via Hidepid Mount Undefined Elastic TOML
Egress Network Connection from Deleted Executable by Root Undefined Elastic TOML
Execution of Hidden File from the Shared Directory Undefined Elastic TOML
File Downloaded via Curl or Wget to Hidden Directory Undefined Elastic TOML

+ 22 more from elastic/protections-artifacts → showing the 10 highest-severity

socfortress/Wazuh-Rules

26 rules · 23 families
Detection Severity Format
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character. 3 variants High Wazuh XML
Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character. 3 variants High Wazuh XML
Suspicious registry modification detected: Hiding user accounts via Userlist key (T1564.002 - Hidden Users) High Wazuh XML
Suspicious use of mkdir to create a hidden directory (starts with a dot) High Wazuh XML
Sysmon - Event 1: Process creation · ADS Creation via certutil or makecab (T1564.004) High Wazuh XML
Sysmon - Event 1: Process creation · ADS Creation via cmd utilities (T1564.004) High Wazuh XML
Sysmon - Event 1: Process creation · ADS Creation via powershell.exe (T1564.004) High Wazuh XML
Sysmon - Event 1: Process creation · ADS Creation via reg.exe (T1564.004) High Wazuh XML
Sysmon - Event 1: Process creation · Create user with (T1564) High Wazuh XML
Sysmon - Event 1: Process creation · Create user with trailing space (T1564) High Wazuh XML

+ 16 more from socfortress/Wazuh-Rules → showing the 10 highest-severity

splunk/security_content

17 rules
Detection Severity Format
Disable Show Hidden Files Undefined SPL
Headless Browser Mockbin or Mocky Request Undefined SPL
Headless Browser Usage Undefined SPL
MacOS Hidden Files and Directories Undefined SPL
O365 BEC Email Hiding Rule Created Undefined SPL
O365 Email New Inbox Rule Created Undefined SPL
O365 Email Transport Rule Changed Undefined SPL
Windows Alternate DataStream - Base64 Content Undefined SPL
Windows Alternate Data Stream Created Over Local Share Undefined SPL
Windows Alternate DataStream - Executable Content Undefined SPL

+ 7 more from splunk/security_content → showing the 10 highest-severity

Azure/Azure-Sentinel

5 rules
Detection Severity Format
Missing Domain Controller Heartbeat High KQL
Fake computer account created Medium KQL
Malware in the recycle bin (Normalized Process Events) Medium KQL
BadUSB HID injection PowerShell via Windows Run dialog Undefined KQL
Fake computer account authentication attempt Undefined KQL

chainguard-dev/osquery-defense-kit

5 rules
Detection Severity Format
Find ssh sessions that are hiding from 'w'/'who' Undefined osquery SQL
Programs running with a hidden current working directory (event-based) Undefined osquery SQL
Programs running with a hidden current working directory (state-based) Undefined osquery SQL
Programs running with a hidden file path or process name Undefined osquery SQL
Reveal launchd services which are located in a hidden directory. Undefined osquery SQL

panther-labs/panther-analysis

2 rules
Detection Severity Format
AppOmni Alert Passthrough Medium Panther Python
Azure Policy DeployIfNotExists Action Triggered Medium Panther Python

chronicle/detection-rules

1 rule
Detection Severity Format
sap_data_changed_during_debugging Critical YARA-L

falcosecurity/rules

1 rule
Detection Severity Format
Create Hidden Files or Directories Low Falco YAML

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.