T1564 Hide Artifacts

Technique

T1564

Tactics

Defense Evasion

Research, 90 days

2

KEV CVEs mapped

0

SigmaHQ rules

10

Elastic, Splunk

42

thrunt rules

0

Upstream

https://attack.mitre.org/techniques/T1564

MITRE description

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.(Citation: Sofacy Komplex Trojan)(Citation: Cybereason OSX Pirrit)(Citation: MalwareBytes ADS July 2015) Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.(Citation: Sophos Ragnar May 2020)

Research citing this technique

Reports and advisories from the last 90 days that cite this technique.

• 2026-10-14 Group-IB: KGB RAT: A Fully Undetectable Windows Trojan Built to Spy, Steal, and Terrorize
• 2026-10-08 Huntress: Threat Actors Exploit Critical AhsayCBS Flaws to Drop Webshells and XMRig Cryptominer

Detection coverage

SigmaHQ community rules

• Mount Execution With Hidepid Parameter (core)
• Suspicious Creation with Colorcpl (core)
• Suspicious Executable File Creation (core)
• PUA - Process Hacker Execution (core)
• PUA - System Informer Execution (core)
• Potentially Suspicious Execution From Parent Process In Public Folder (core)
• Virtualbox Driver Installation or Starting of VMs (core)
• CrashControl CrashDump Disabled (core)
• Sysmon Configuration Error (core)
• Sysmon Configuration Modification (core)

Elastic and Splunk rules

• Claude Cowork VM Boot Image Tamper (elastic)
• Potential Kubectl Masquerading via Unexpected Process (elastic)
• Suspicious Process Execution Detected via Defend for Containers (elastic)
• Persistence via a Hidden Plist Filename via macOS Security Events (elastic)
• M365 Exchange Inbox Rule with Obfuscated Name (elastic)
• M365 Exchange Inbox Phishing Evasion Rule Created (elastic)
• High Number of Egress Network Connections from Unusual Executable (elastic)
• System Binary Moved or Copied (elastic)
• Hidden Files and Directories via Hidden Flag (elastic)
• Directory Creation in /bin directory (elastic)
• Hidden Directory Creation via Unusual Parent (elastic)
• Hidden File Created in System Directory by Suspicious Process (elastic)
• Creation of Hidden Files and Directories via CommandLine (elastic)
• Creation of Hidden Shared Object File (elastic)
• Unusual Interactive Shell Launched from System User (elastic)
• Kill Command Execution (elastic)
• Executable Masquerading as Kernel Process (elastic)
• Potential Hidden Process via Mount Hidepid (elastic)
• Suspicious Path Mounted (elastic)
• System Binary Symlink to Suspicious Location (elastic)
• File Creation in /var/log via Suspicious Process (elastic)
• Process Backgrounded by Unusual Parent (elastic)
• Direct Process Execution via Background Utility (elastic)
• Suspicious Path Invocation from Command Line (elastic)
• Unusual Login via System User (elastic)

Showing 25 of 42.

Signal counts reflect the current corpus snapshot. Research citations are the technique IDs named in vendor reports and government advisories from the last 90 days; KEV mappings come from MITRE CTID. Coverage is the SigmaHQ rule inventory (core, emerging-threats, threat-hunting) at release r2026-07-01 plus Elastic and Splunk production rules. Rule bodies are not mirrored; links go upstream.