Description
Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line. Users must explicitly ask to show the hidden files either via a series of Graphical User Interface (GUI) prompts or with command line switches (dir /a for Windows and ls –a for Linux and macOS).
On Linux and Mac, users can mark specific files as hidden simply by putting a “.” as the first character in the file or folder name (Citation: Sofacy Komplex Trojan) (Citation: Antiquated Mac Malware). Files and folders that start with a period, ‘.’, are by default hidden from being viewed in the Finder application and standard command-line utilities like “ls”. Users must specifically change settings to have these files viewable.
Files on macOS can also be marked with the UF_HIDDEN flag which prevents them from being seen in Finder.app, but still allows them to be seen in Terminal.app (Citation: WireLurker). On Windows, users can mark specific files as hidden by using the attrib.exe binary. Many applications create these hidden files and folders to store information so that it doesn’t clutter up the user’s workspace. For example, SSH utilities create a .ssh folder that’s hidden and contains the user’s known hosts and keys.
Additionally, adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a “space” character.
Adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files.
Platforms
Threat Groups (13)
| ID | Group | Context |
|---|---|---|
| G0050 | APT32 | [APT32](https://attack.mitre.org/groups/G0050)'s macOS backdoor hides the clientID file via a chflags function.(Citation: ESET OceanLotus macOS April ... |
| G0125 | HAFNIUM | [HAFNIUM](https://attack.mitre.org/groups/G0125) has hidden files on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021) |
| G0046 | FIN7 | [FIN7](https://attack.mitre.org/groups/G0046) has used `attrib +h “C:\ProgramData\ssh”` to make the SSH folder hidden.(Citation: BlackBerry_FIN7_April... |
| G0129 | Mustang Panda | [Mustang Panda](https://attack.mitre.org/groups/G0129)'s [PlugX](https://attack.mitre.org/software/S0013) variant has created a hidden folder on USB d... |
| G0106 | Rocke | [Rocke](https://attack.mitre.org/groups/G0106) downloaded a file "libprocesshider", which could hide files on the target system.(Citation: Talos Rocke... |
| G0081 | Tropic Trooper | [Tropic Trooper](https://attack.mitre.org/groups/G0081) has created a hidden directory under <code>C:\ProgramData\Apple\Updates\</code> and <code>C:\U... |
| G1039 | RedCurl | [RedCurl](https://attack.mitre.org/groups/G1039) added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK f... |
| G1014 | LuminousMoth | [LuminousMoth](https://attack.mitre.org/groups/G1014) has used malware to store malicious binaries in hidden directories on victim's USB drives.(Citat... |
| G0007 | APT28 | [APT28](https://attack.mitre.org/groups/G0007) has saved files with hidden file attributes.(Citation: Talos Seduploader Oct 2017)(Citation: Talos Sedu... |
| G0032 | Lazarus Group | [Lazarus Group](https://attack.mitre.org/groups/G0032) has used a VBA Macro to set its file attributes to System and Hidden and has named files with a... |
| G0134 | Transparent Tribe | [Transparent Tribe](https://attack.mitre.org/groups/G0134) can hide legitimate directories and replace them with malicious copies of the same name.(Ci... |
| G1016 | FIN13 | [FIN13](https://attack.mitre.org/groups/G1016) has created hidden files and folders within a compromised Linux system `/tmp` directory. [FIN13](https:... |
| G1056 | TeamPCP | [TeamPCP](https://attack.mitre.org/groups/G1056) has used a hidden .lock file to establish a 12 hour cooldown period between re-drops for installed ma... |
Associated Software (46)
| ID | Name | Type | Context |
|---|---|---|---|
| S1105 | COATHANGER | Malware | [COATHANGER](https://attack.mitre.org/software/S1105) creates and installs itself to a hidden installation directory.(Citation: NCSC-NL COATHANGER Feb... |
| S0198 | NETWIRE | Malware | [NETWIRE](https://attack.mitre.org/software/S0198) can copy itself to and launch itself from hidden folders.(Citation: Red Canary NETWIRE January 2020... |
| S0278 | iKitten | Malware | [iKitten](https://attack.mitre.org/software/S0278) saves itself with a leading "." so that it's hidden from users by default.(Citation: objsee mac mal... |
| S0634 | EnvyScout | Malware | [EnvyScout](https://attack.mitre.org/software/S0634) can use hidden directories and files to hide malicious executables.(Citation: MSTIC Nobelium Tool... |
| S0409 | Machete | Malware | [Machete](https://attack.mitre.org/software/S0409) has the capability to exfiltrate stolen data to a hidden folder on a removable drive.(Citation: ESE... |
| S0497 | Dacls | Malware | [Dacls](https://attack.mitre.org/software/S0497) has had its payload named with a dot prefix to make it hidden from view in the Finder application.(Ci... |
| S1153 | Cuckoo Stealer | Malware | [Cuckoo Stealer](https://attack.mitre.org/software/S1153) has copied its binary and the victim's scraped password into a hidden folder in the `/Users`... |
| S0612 | WastedLocker | Malware | [WastedLocker](https://attack.mitre.org/software/S0612) has copied a random file from the Windows System32 folder to the <code>%APPDATA%</code> locati... |
| S0260 | InvisiMole | Malware | [InvisiMole](https://attack.mitre.org/software/S0260) can create hidden system directories.(Citation: ESET InvisiMole June 2020) |
| S1236 | CLAIMLOADER | Malware | [CLAIMLOADER](https://attack.mitre.org/software/S1236) has modified file attributes to remain hidden to a standard user.(Citation: 2025_IBM_PUBLOAD_TO... |
| S0277 | FruitFly | Malware | [FruitFly](https://attack.mitre.org/software/S0277) saves itself with a leading "." to make it a hidden file.(Citation: objsee mac malware 2017) |
| S0439 | Okrum | Malware | Before exfiltration, [Okrum](https://attack.mitre.org/software/S0439)'s backdoor has used hidden files to store logs and outputs from backdoor command... |
| S1219 | REPTILE | Malware | [REPTILE](https://attack.mitre.org/software/S1219) has the ability to communicate with the kernel-mode component to hide files.(Citation: Google Cloud... |
| S0448 | Rising Sun | Malware | [Rising Sun](https://attack.mitre.org/software/S0448) can modify file attributes to hide files.(Citation: McAfee Sharpshooter December 2018) |
| S0013 | PlugX | Malware | [PlugX](https://attack.mitre.org/software/S0013) can modify the characteristics of folders to hide them from the compromised user.(Citation: Proofpoin... |
| S0569 | Explosive | Malware | [Explosive](https://attack.mitre.org/software/S0569) has commonly set file and path attributes to hidden.(Citation: CheckPoint Volatile Cedar March 20... |
| S0660 | Clambling | Malware | [Clambling](https://attack.mitre.org/software/S0660) has the ability to set its file attributes to hidden.(Citation: Trend Micro DRBControl February 2... |
| S1111 | DarkGate | Malware | [DarkGate](https://attack.mitre.org/software/S1111) initial installation involves dropping several files to a hidden directory named after the victim ... |
| S0595 | ThiefQuest | Malware | [ThiefQuest](https://attack.mitre.org/software/S0595) hides a copy of itself in the user's <code>~/Library</code> directory by using a <code>.</code> ... |
| S0366 | WannaCry | Malware | [WannaCry](https://attack.mitre.org/software/S0366) uses <code>[attrib](https://attack.mitre.org/software/S1176) +h</code> to make some of its files h... |
References
- Claud Xiao. (n.d.). WireLurker: A New Era in iOS and OS X Malware. Retrieved July 10, 2017.
- Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
- Thomas Reed. (2017, January 18). New Mac backdoor using antiquated code. Retrieved July 5, 2017.
Frequently Asked Questions
What is T1564.001 (Hidden Files and Directories)?
T1564.001 is a MITRE ATT&CK technique named 'Hidden Files and Directories'. It belongs to the Stealth tactic(s). Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the conc...
How can T1564.001 be detected?
Detection of T1564.001 (Hidden Files and Directories) typically involves monitoring system logs, network traffic, and endpoint telemetry. Use SIEM rules, EDR solutions, and behavioral analytics to identify suspicious activity associated with this technique.
What mitigations exist for T1564.001?
Follow defense-in-depth principles including network segmentation, least privilege access, security monitoring, and regular patching to reduce the risk of this technique.
Which threat groups use T1564.001?
Known threat groups using T1564.001 include: APT32, HAFNIUM, FIN7, Mustang Panda, Rocke, Tropic Trooper, RedCurl, LuminousMoth.