T1083 — File and Directory Discovery
Tactic: Discovery · Platforms: ESXi, Linux, macOS, Network Devices, Windows
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including…
Sigma detection rules (5)
T1083 File and Directory Discovery
title: T1083 File and Directory Discovery
id: aec8bff4-abb7-4bef-9a0b-d97c7c7ca7ec
description: 'Recursive Enumeration of Files and Directories via Command-Line and PowerShell Utilities. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: CommandLineRegex, UserContext, TimeWindow.'
references:
- https://attack.mitre.org/techniques/T1083
author: Shahrukh Khan
date: 2026-04-03
license: MIT
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: windows
detection:
selection_dir:
Image|endswith: '\cmd.exe'
CommandLine|contains|all:
- 'dir'
- '/s'
selection_tree:
Image|endswith: '\tree.com'
CommandLine|contains: '/f'
selection_powershell_recurse:
Image|endswith:
- '\powershell.exe'
- '\pwsh.exe'
CommandLine|contains|all:
- 'Get-ChildItem'
- '-Recurse'
selection_forfiles:
Image|endswith: '\forfiles.exe'
condition: 1 of selection_*
falsepositives:
- Common benign admin/backup scripts.
level: informational
T1083 File and Directory Discovery
title: T1083 File and Directory Discovery
id: e467efd1-5530-46e6-b849-557abf15b5ca
description: 'Recursive Enumeration of Files and Directories Across Privilege Contexts. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Broadened the find selection beyond an exact a1 == "/" match: now also matches find invocations targeting /home, /etc, or /var (and their subpaths), which are equally common discovery targets, in addition to a literal full-filesystem scan from root. Tune using: FilePathDepth, UserContext.'
references:
- https://attack.mitre.org/techniques/T1083
author: Shahrukh Khan
date: 2026-04-05
license: MIT
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
detection:
selection_find_root:
type: EXECVE
a0|endswith: '/find'
a1: '/'
selection_find_sensitive:
type: EXECVE
a0|endswith: '/find'
a1|startswith:
- '/home'
- '/etc'
- '/var'
selection_ls:
type: EXECVE
a0|endswith: '/ls'
a1|contains: '-laR'
condition: 1 of selection*
falsepositives:
- Broad find/ls scans of the filesystem root, /home, /etc, or /var are used legitimately by backup software, AV/EDR scanners, config-management tools, and disk-usage tooling; scope to interactive user sessions (tune UserContext).
level: low
T1083 File and Directory Discovery
title: T1083 File and Directory Discovery
id: da0f58ac-8a4e-45c6-b54b-a3c7699d7626
description: 'Recursive Enumeration of Files and Directories Across Privilege Contexts. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: PredicateScope, TimeWindow.'
references:
- https://attack.mitre.org/techniques/T1083
author: Shahrukh Khan
date: 2026-03-11
license: MIT
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: macos
detection:
selection:
Image|endswith:
- '/find'
- '/mdfind'
- '/ls'
CommandLine|contains:
- '-name'
- 'kMDItem'
condition: selection
falsepositives:
- Everyday developer use of find and mdfind, and Spotlight-based user search, produce identical events.
level: informational
T1083 File and Directory Discovery
title: T1083 File and Directory Discovery
id: 8c5ae478-3449-4d3b-bc04-18494e0fc1fc
description: 'Detects find/locate invocations narrowed to SUID/SGID-binary hunting (-perm -4000 / -perm -2000) or searches targeting sensitive paths (SSH keys, /etc/shadow, home directories) combined with a non-interactive session (auid unset, i.e. no real login), which is a materially stronger privilege-escalation-recon signal than any find/locate use with -perm or -name. (Data Component: Command Execution; baseline tier: fallback.) Tune using: CommandWhitelist, SessionOrigin.'
references:
- https://attack.mitre.org/techniques/T1083
author: Shahrukh Khan
date: 2026-03-28
license: MIT
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: linux
service: auditd
detection:
selection_tool:
- type: EXECVE
a0|endswith: '/find'
- type: EXECVE
a0|endswith: '/locate'
selection_suid:
- a1: '-perm'
a2|contains:
- '4000'
- '2000'
- a2: '-perm'
a3|contains:
- '4000'
- '2000'
selection_sensitive_path:
a1|contains:
- '/home'
- '.ssh'
- '/etc/shadow'
- 'id_rsa'
selection_noninteractive:
auid: 4294967295
condition: selection_tool and (selection_suid or selection_sensitive_path) and selection_noninteractive
falsepositives:
- Automated hardening or audit tooling (e.g. Lynis, CIS-benchmark scanners, backup scripts) that hunts SUID/SGID binaries or scans home directories from a cron job or service account with no login session; scope CommandWhitelist to known scanners or widen SessionOrigin if benign non-interactive tooling is expected.
level: medium
T1083 File and Directory Discovery
title: T1083 File and Directory Discovery
id: 9e9efa76-b0b3-4719-8d0c-2ed07aa946e2
description: 'Recursive Enumeration of Files and Directories Across Privilege Contexts. (Retargeted to the process_creation ESXi telemetry that actually captures this techniques behavior; see logsource below.) Tune using: CLICommandPattern, AccessSource.'
references:
- https://attack.mitre.org/techniques/T1083
author: Shahrukh Khan
date: 2026-03-10
license: MIT
tags:
- attack.discovery
- attack.t1083
logsource:
category: process_creation
product: esxi
service: shell
detection:
selection:
CommandLine|contains:
- 'find /vmfs/volumes/'
- 'ls -la /vmfs/volumes/'
condition: selection
falsepositives:
- Administrators browsing datastores to check free space or locate VM files will also match.
level: informational
Explore