T1564.001 — Hidden Files and Directories

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.001 Hide Artifacts: Hidden Files and Directories

title: "T1564.001 Hide Artifacts: Hidden Files and Directories"
id: b1e24df2-3ddd-466d-b531-078f618f710b
description: 'Detects use of attrib.exe to set the hidden attribute (+h) on files or directories, the primary native Windows technique for hiding files from normal directory listings. (Data Component: Process Creation; baseline tier: windows-eventid.) Tune using: MonitoredExtensions, ADSMonitoring.'
references:
  - https://attack.mitre.org/techniques/T1564/001
author: Shahrukh Khan
date: 2026-03-02
license: MIT
tags:
  - attack.stealth
  - attack.t1564.001

logsource:
  category: process_creation
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 1
    Image|endswith: '\attrib.exe'
    CommandLine|contains|windash: '+h'

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate administrative or installer scripts hiding support/config files.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1564.001 Hide Artifacts: Hidden Files and Directories

title: "T1564.001 Hide Artifacts: Hidden Files and Directories"
id: ca1c6507-4360-4cba-923e-32f53601c1f8
description: 'Detection Strategy for Hidden Files and Directories. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) Tune using: DirectoryScope.'
references:
  - https://attack.mitre.org/techniques/T1564/001
author: Shahrukh Khan
date: 2026-03-18
license: MIT
tags:
  - attack.stealth
  - attack.t1564.001

logsource:
  category: process_creation
  product: linux

detection:
  selection:
    type: EXECVE
    a0|endswith:
      - '/mkdir'
      - '/touch'
      - '/cp'
      - '/mv'
    a1|re: '(^|/)\.[^/]+
    
  


    a1|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'

  condition: selection

falsepositives:
  - Legitimate applications routinely create dotfiles/dot-directories (e.g. .cache, .config) even under /tmp for lockfiles.

level: medium

T1564.001 Hide Artifacts: Hidden Files and Directories

title: "T1564.001 Hide Artifacts: Hidden Files and Directories"
id: e3912940-1c4c-4176-b6d7-bc1441ace830
description: 'Detection Strategy for Hidden Files and Directories. (Retargeted to the process_creation macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: HiddenAttributeScope.'
references:
  - https://attack.mitre.org/techniques/T1564/001
author: Shahrukh Khan
date: 2026-06-02
license: MIT
tags:
  - attack.stealth
  - attack.t1564.001

logsource:
  category: process_creation
  product: macos

detection:
  selection:
    Image|endswith: '/chflags'
    CommandLine|contains: 'hidden'
  selection2:
    Image|endswith: '/mv'
    CommandLine|re: '\s\.[A-Za-z0-9_]+
    
  



  condition: 1 of selection*

falsepositives:
  - Users or scripts renaming personal configuration files with a leading dot as part of normal dotfile management.

level: medium

Related sub-techniques

Explore