T1564.005 — Hidden File System

Tactic: Stealth · Platforms: Linux, macOS, Windows

Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories,…

Sub-technique of Hide Artifacts (T1564).

Sigma detection rules (3)

T1564.005 Hide Artifacts: Hidden File System

title: "T1564.005 Hide Artifacts: Hidden File System"
id: e6650c6b-73a4-47a8-8287-4d3ceea2eadf
description: 'A custom hidden file system (VFS) stored outside standard NTFS/FAT structures cannot be observed via a specific Windows event; the closest defensible proxy is Sysmon RawAccessRead (EventID 9), which flags a process reading raw disk/volume data directly (e.g. \\.\PhysicalDrive0) instead of through normal file system APIs, consistent with implementing or accessing a hidden VFS. This is a coarse proxy also triggered by legitimate disk, backup, and forensic tools, so tune the allowlist accordingly. (Data Component: Raw Access Read; baseline tier: windows-eventid.) Tune using: TrustedDiskTools, ProcessAllowlist, TimeWindow.'
references:
  - https://attack.mitre.org/techniques/T1564/005
author: Shahrukh Khan
date: 2026-06-25
license: MIT
tags:
  - attack.stealth
  - attack.t1564.005

logsource:
  category: raw_access_read
  product: windows
  service: sysmon

detection:
  selection:
    EventID: 9

  filter_system_account:
    User|contains:
      - 'SYSTEM'
      - 'LOCAL SERVICE'
      - 'NETWORK SERVICE'

  condition: selection and not filter_system_account

falsepositives:
  - Legitimate disk imaging, backup, antivirus, and forensic tools that read raw disk/volume data directly.
  - System and service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) performing the same action are excluded via filter_system_account; tune further with process/path allowlists if noise remains.

level: medium

T1564.005 Hide Artifacts: Hidden File System

title: "T1564.005 Hide Artifacts: Hidden File System"
id: 69d88c34-7c70-47f5-88d5-a43ae5d8af75
description: 'Detection Strategy for Hidden File System Abuse. (Retargeted to the process_creation auditd telemetry that actually captures this techniques behavior; see logsource below.) mount -oloop and cryptsetup luksOpen are common, legitimate backup/VM/encryption admin operations, so the prior unscoped 1-of match was a generic proxy rather than an indicator of an adversary-built hidden file system. Now requires loop-mounts to target a mount point outside the standard /mnt, /media, /run/media locations, and requires luksOpen to open a container staged in a suspicious location (/tmp, /dev/shm, /var/tmp, or a hidden dot-path) rather than a normal backup volume path. Tune using: AllowedMountPoints, UserContext.'
references:
  - https://attack.mitre.org/techniques/T1564/005
author: Shahrukh Khan
date: 2026-06-14
license: MIT
tags:
  - attack.stealth
  - attack.t1564.005

logsource:
  category: process_creation
  product: linux

detection:
  selection_loop:
    type: EXECVE
    a0|endswith: '/mount'
    a1|contains: '-oloop'
  filter_loop_standard:
    type: EXECVE
    a0|endswith: '/mount'
    a3|contains:
      - '/mnt/'
      - '/media/'
      - '/run/media/'
  selection_crypt:
    type: EXECVE
    a0|endswith: '/cryptsetup'
    a1|contains: 'luksOpen'
  selection_crypt_suspicious:
    type: EXECVE
    a0|endswith: '/cryptsetup'
    a2|contains:
      - '/tmp/'
      - '/dev/shm/'
      - '/var/tmp/'
      - '/.'

  condition: (selection_loop and not filter_loop_standard) or (selection_crypt and selection_crypt_suspicious)

falsepositives:
  - Legitimate use of loop-mounted disk images or encrypted containers for backups/VMs by administrators, when staged/mounted outside standard locations (tune AllowedMountPoints/UserContext).

level: medium

T1564.005 Hide Artifacts: Hidden File System

title: "T1564.005 Hide Artifacts: Hidden File System"
id: 4eb6aca4-36a8-4d46-8411-1eff4b1ba2a5
description: 'Detection Strategy for Hidden File System Abuse. (Retargeted to the file_change macOS unified-log telemetry that actually captures this techniques behavior; see logsource below.) Tune using: MonitoredPlistPaths, ProcessScope.'
references:
  - https://attack.mitre.org/techniques/T1564/005
author: Shahrukh Khan
date: 2026-01-10
license: MIT
tags:
  - attack.stealth
  - attack.t1564.005

logsource:
  category: file_change
  product: macos

detection:
  selection:
    TargetFilename|contains: 'com.apple.finder.plist'

  condition: selection

falsepositives:
  - This is a very weak signal because macOS has no genuine concept of a hidden file system volume outside APFS containers, and Finder preference changes are extremely common and mostly benign.

level: low

Related sub-techniques

Explore