Description
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)
Some files and directories may require elevated or specific user permissions to access.
Platforms
Threat Groups (52)
| ID | Group | Context |
|---|---|---|
| G0082 | APT38 | [APT38](https://attack.mitre.org/groups/G0082) have enumerated files and directories, or searched in specific locations within a compromised host.(Cit... |
| G0022 | APT3 | [APT3](https://attack.mitre.org/groups/G0022) has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine ... |
| G0094 | Kimsuky | [Kimsuky](https://attack.mitre.org/groups/G0094) has the ability to enumerate all files and directories on an infected system.(Citation: Securelist Ki... |
| G0018 | admin@338 | [admin@338](https://attack.mitre.org/groups/G0018) actors used the following commands after exploiting a machine with [LOWBALL](https://attack.mitre.o... |
| G1017 | Volt Typhoon | [Volt Typhoon](https://attack.mitre.org/groups/G1017) has enumerated directories containing vulnerability testing and cyber related content and facili... |
| G0040 | Patchwork | A [Patchwork](https://attack.mitre.org/groups/G0040) payload has searched all fixed drives on the victim for files matching a specified list of extens... |
| G0096 | APT41 | [APT41](https://attack.mitre.org/groups/G0096) has executed <code>file /bin/pwd</code> on exploited victims, perhaps to return architecture related in... |
| G0035 | Dragonfly | [Dragonfly](https://attack.mitre.org/groups/G0035) has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-0... |
| G0045 | menuPass | [menuPass](https://attack.mitre.org/groups/G0045) has searched compromised systems for folders of interest including those related to HR, audit and ex... |
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLo... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0069 | MuddyWater | [MuddyWater](https://attack.mitre.org/groups/G0069) has used malware that checked if the ProgramData folder had folders or files with the keywords "Ka... |
| G0047 | Gamaredon Group | [Gamaredon Group](https://attack.mitre.org/groups/G0047) macros can scan for Microsoft Word and Excel files to inject with additional malicious macros... |
| G0077 | Leafminer | [Leafminer](https://attack.mitre.org/groups/G0077) used a tool called MailSniper to search for files on the desktop and another utility called Sobolso... |
| G0139 | TeamTNT | [TeamTNT](https://attack.mitre.org/groups/G0139) has used a script that checks `/proc/*/environ` for environment variables related to AWS.(Citation: C... |
| G0034 | Sandworm Team | [Sandworm Team](https://attack.mitre.org/groups/G0034) has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 744... |
| G0026 | APT18 | [APT18](https://attack.mitre.org/groups/G0026) can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016) |
| G0121 | Sidewinder | [Sidewinder](https://attack.mitre.org/groups/G0121) has used malware to collect information on files and directories.(Citation: ATT Sidewinder January... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129) has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citat... |
| G1015 | Scattered Spider | [Scattered Spider](https://attack.mitre.org/groups/G1015) Spider enumerates a target organization for files and directories of interest, including sou... |
Associated Software (308)
| ID | Name | Type | Context |
|---|---|---|---|
| S0266 | TrickBot | Malware | [TrickBot](https://attack.mitre.org/software/S0266) searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp... |
| S0139 | PowerDuke | Malware | [PowerDuke](https://attack.mitre.org/software/S0139) has commands to get the current directory name as well as the size of a file. It also has command... |
| S0520 | BLINDINGCAN | Malware | [BLINDINGCAN](https://attack.mitre.org/software/S0520) can search, read, write, move, and execute files.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citat... |
| S1100 | Ninja | Malware | [Ninja](https://attack.mitre.org/software/S1100) has the ability to enumerate directory content.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kas... |
| S0686 | QuietSieve | Malware | [QuietSieve](https://attack.mitre.org/software/S0686) can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, ... |
| S0242 | SynAck | Malware | [SynAck](https://attack.mitre.org/software/S0242) checks its directory location in an attempt to avoid launching in a sandbox.(Citation: SecureList Sy... |
| S9015 | BRICKSTORM | Malware | [BRICKSTORM](https://attack.mitre.org/software/S9015) has identified specific files and directories within targeted hosts and systems for modification... |
| S1125 | AcidRain | Malware | [AcidRain](https://attack.mitre.org/software/S1125) identifies specific files and directories in the Linux operating system associated with storage de... |
| S1025 | Amadey | Malware | [Amadey](https://attack.mitre.org/software/S1025) has searched for folders associated with antivirus software.(Citation: Korean FSI TA505 2020) |
| S0238 | Proxysvc | Malware | [Proxysvc](https://attack.mitre.org/software/S0238) lists files in directories.(Citation: McAfee GhostSecret) |
| S0229 | Orz | Malware | [Orz](https://attack.mitre.org/software/S0229) can gather victim drive information.(Citation: Proofpoint Leviathan Oct 2017) |
| S0248 | yty | Malware | [yty](https://attack.mitre.org/software/S0248) gathers information on victim’s drives and has a plugin for document listing.(Citation: ASERT Donot Mar... |
| S0093 | Backdoor.Oldrea | Malware | [Backdoor.Oldrea](https://attack.mitre.org/software/S0093) collects information about available drives, default browser, desktop file list, My Documen... |
| S0603 | Stuxnet | Malware | [Stuxnet](https://attack.mitre.org/software/S0603) uses a driver to scan for specific filesystem driver objects.(Citation: Nicolas Falliere, Liam O Mu... |
| S1053 | AvosLocker | Malware | [AvosLocker](https://attack.mitre.org/software/S1053) has searched for files and directories on a compromised network.(Citation: Malwarebytes AvosLock... |
| S0184 | POWRUNER | Malware | [POWRUNER](https://attack.mitre.org/software/S0184) may enumerate user directories on a victim.(Citation: FireEye APT34 Dec 2017) |
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) will survey the contents of system files during installation.(Citation: NCSC-NL COATHANGER Feb 2... |
| S0226 | Smoke Loader | Malware | [Smoke Loader](https://attack.mitre.org/software/S0226) recursively searches through directories for files.(Citation: Talos Smoke Loader July 2018) |
| S0466 | WindTail | Malware | [WindTail](https://attack.mitre.org/software/S0466) has the ability to enumerate the users home directory and the path to its own application bundle.(... |
| S0083 | Misdat | Malware | [Misdat](https://attack.mitre.org/software/S0083) is capable of running commands to obtain a list of files and directories, as well as enumerating log... |
References
- Tomonaga, S. (2016, January 26). Windows Commands Abused by Attackers. Retrieved February 2, 2016.
- US-CERT. (2018, April 20). Alert (TA18-106A) Russian State-Sponsored Cyber Actors Targeting Network Infrastructure Devices. Retrieved October 19, 2020.
Frequently Asked Questions
What is T1083 (File and Directory Discovery)?
T1083 is a MITRE ATT&CK technique named 'File and Directory Discovery'. It belongs to the Discovery tactic(s). Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [F...
How can T1083 be detected?
Detection of T1083 (File and Directory Discovery) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1083?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1083?
Known threat groups using T1083 include: APT38, APT3, Kimsuky, admin@338, Volt Typhoon, Patchwork, APT41, Dragonfly.