Applied Cybernetics Group
T1564.001 Hidden Files and Directories
- Technique
T1564.001- Tactics
- Defense Evasion
- Research, 90 days
- 1
- KEV CVEs mapped
- 0
- SigmaHQ rules
- 9
- Elastic, Splunk
- 20
- thrunt rules
- 0
- Upstream
- https://attack.mitre.org/techniques/T1564/001
MITRE description
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (<code>dir /a</code> for Windows and <code>ls –a</code> for Linux and macOS). On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name.(Citation: Sofacy Komplex Trojan)(Citation: Antiquated Mac Malware) Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable. Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app.(Citation: WireLurker) On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys. Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character. Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
Research citing this technique
Reports and advisories from the last 90 days that cite this technique.
-
2026-10-14Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
Detection coverage
SigmaHQ community rules
- Atomic MacOS Stealer - Persistence Indicators (emerging-threats)
- Set Files as System Files Using Attrib.EXE (threat-hunting)
- Hidden Files and Directories (core)
- Hiding Files with Attrib.exe (core)
- Set Suspicious Files as System Files Using Attrib.EXE (core)
- Use Icacls to Hide File to Everyone (core)
- Registry Persistence via Service in Safe Mode (core)
- Displaying Hidden Files Feature Disabled (core)
- PowerShell Logging Disabled Via Registry Key Tampering (core)
Elastic and Splunk rules
- Potential Kubectl Masquerading via Unexpected Process (elastic)
- Suspicious Process Execution Detected via Defend for Containers (elastic)
- Persistence via a Hidden Plist Filename via macOS Security Events (elastic)
- High Number of Egress Network Connections from Unusual Executable (elastic)
- Hidden Files and Directories via Hidden Flag (elastic)
- Directory Creation in /bin directory (elastic)
- Hidden Directory Creation via Unusual Parent (elastic)
- Hidden File Created in System Directory by Suspicious Process (elastic)
- Creation of Hidden Files and Directories via CommandLine (elastic)
- Creation of Hidden Shared Object File (elastic)
- Kill Command Execution (elastic)
- Potential Hidden Process via Mount Hidepid (elastic)
- File Creation in /var/log via Suspicious Process (elastic)
- Suspicious Hidden Child Process of Launchd (elastic)
- Creation of Hidden Launch Agent or Daemon (elastic)
- Persistence via a Hidden Plist Filename (elastic)
- Adding Hidden File Attribute via Attrib (elastic)
- File Staged in Root Folder of Recycle Bin (elastic)
- Disable Show Hidden Files (splunk)
- MacOS Hidden Files and Directories (splunk)