Hide Artifacts

T1564

Technique with 14 sub-techniques.View on attack.mitre.org

About this technique

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.

Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.

Detection rules71

Rules on DetectionCode tagged with T1564 or one of its sub-techniques.

Sigma53

Rule	Level	Log source	Technique
Exports Registry Key To an Alternate Data Stream	high	windows / create_stream_hash	T1564.004
File Download with Headless Browser	high	windows / process_creation	T1564.003
HackTool - Covenant PowerShell Launcher	high	windows / process_creation	T1564.003
HackTool Named File Stream Created	high	windows / create_stream_hash	T1564.004
Hiding User Account Via SpecialAccounts Registry Key	high	windows / registry_set	T1564.002
NTFS Alternate Data Stream	high	windows / ps_script	T1564.004
Potential Data Stealing Via Chromium Headless Debugging	high	windows / process_creation	T1564.003
Potential Rundll32 Execution With DLL Stored In ADS	high	windows / process_creation	T1564.004
Potentially Suspicious Execution From Parent Process In Public Folder	high	windows / process_creation	T1564
PowerShell Logging Disabled Via Registry Key Tampering	high	windows / registry_set	T1564.001
PrintBrm ZIP Creation of Extraction	high	windows / process_creation	T1564.004
Registry Persistence via Service in Safe Mode	high	windows / registry_set	T1564.001
Run PowerShell Script from ADS	high	windows / process_creation	T1564.004
Set Suspicious Files as System Files Using Attrib.EXE	high	windows / process_creation	T1564.001
Suspicious Creation with Colorcpl	high	windows / file_event	T1564
Suspicious Executable File Creation	high	windows / file_event	T1564
Suspicious File Download From File Sharing Websites - File Stream	high	windows / create_stream_hash	T1564.004
Sysmon Configuration Error	high	windows / sysmon_error	T1564
Sysmon Configuration Modification	high	windows / sysmon_status	T1564
Unusual File Download from Direct IP Address	high	windows / create_stream_hash	T1564.004
Cmd Launched with Hidden Start Flags to Suspicious Targets	medium	windows / process_creation	T1564.003
CrashControl CrashDump Disabled	medium	windows / registry_set	T1564
Displaying Hidden Files Feature Disabled	medium	windows / registry_set	T1564.001
Execute From Alternate Data Streams	medium	windows / process_creation	T1564.004
Hidden Executable In NTFS Alternate Data Stream	medium	windows / create_stream_hash	T1564.004
Hidden Flag Set On File/Directory Via Chflags - MacOS	medium	macos / process_creation	T1564.004
Hidden User Creation	medium	macos / process_creation	T1564.002
Hiding Files with Attrib.exe	medium	windows / process_creation	T1564.001
Hiding User Account Via SpecialAccounts Registry Key - CommandLine	medium	windows / process_creation	T1564.002
Mount Execution With Hidepid Parameter	medium	linux / process_creation	T1564
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream	medium	windows / file_event	T1564.004
Potential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLI	medium	windows / process_creation	T1564.004
Potential Suspicious Activity Using SeCEdit	medium	windows / process_creation	T1564.002
Powershell Executed From Headless ConHost Process	medium	windows / process_creation	T1564.003
Powershell Store File In Alternate Data Stream	medium	windows / ps_script	T1564.004
PUA - AdvancedRun Execution	medium	windows / process_creation	T1564.003
PUA - Process Hacker Execution	medium	windows / process_creation	T1564
PUA - System Informer Execution	medium	windows / process_creation	T1564
Remote File Download Via Findstr.EXE	medium	windows / process_creation	T1564.004
Suspicious Diantz Alternate Data Stream Execution	medium	windows / process_creation	T1564.004
Suspicious Extrac32 Alternate Data Stream Execution	medium	windows / process_creation	T1564.004
Suspicious Hyper-V Cmdlets	medium	windows / ps_script	T1564.006
Suspicious PowerShell WindowStyle Option	medium	windows / ps_script	T1564.003
Unusual File Download From File Sharing Websites - File Stream	medium	windows / create_stream_hash	T1564.004
Use Icacls to Hide File to Everyone	medium	windows / process_creation	T1564.001
Use NTFS Short Name in Command Line	medium	windows / process_creation	T1564.004
Use NTFS Short Name in Image	medium	windows / process_creation	T1564.004
Use Short Name Path in Command Line	medium	windows / process_creation	T1564.004
Use Short Name Path in Image	medium	windows / process_creation	T1564.004
Browser Execution In Headless Mode	low	windows / process_creation	T1564.003
Hidden Files and Directories	low	linux / NULL	T1564.001
Insensitive Subfolder Search Via Findstr.EXE	low	windows / process_creation	T1564.004
Virtualbox Driver Installation or Starting of VMs	low	windows / process_creation	T1564 T1564.006

Splunk18

Rule	Type	Risk	Data source	Technique
Disable Show Hidden Files	Anomaly	NULL	Sysmon EventID 13	T1564.001
Headless Browser Mockbin or Mocky Request	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564.003
Headless Browser Usage	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564.003
MacOS Hidden Files and Directories	Anomaly	NULL	Osquery Results	T1564.001
O365 BEC Email Hiding Rule Created	TTP	NULL		T1564.008
O365 Email New Inbox Rule Created	Anomaly	NULL	Office 365 Universal Audit Log	T1564.008
O365 Email Transport Rule Changed	Anomaly	NULL	Office 365 Universal Audit Log	T1564.008
Reg exe used to hide files directories via registry keys	TTP	NULL	Sysmon EventID 1	T1564.001
Windows Alternate Data Stream Created Over Local Share	Anomaly	NULL	Windows Event Log Security 5145	T1564.004
Windows Alternate DataStream - Base64 Content	TTP	NULL	Sysmon EventID 15	T1564.004
Windows Alternate DataStream - Executable Content	TTP	NULL	Sysmon EventID 15	T1564.004
Windows Alternate DataStream - Process Execution	TTP	NULL	Windows Event Log Security 4688, Sysmon EventID 1	T1564.004
Windows ConHost with Headless Argument	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564.003 T1564.006
Windows New Deny Permission Set On Service SD Via Sc.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564
Windows New Service Security Descriptor Set Via Sc.EXE	Anomaly	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564
Windows Suspicious QEMU Execution	TTP	NULL	Sysmon EventID 1	T1564.006
Windows SymbolicLink-Testing-Tools Utility Execution	TTP	NULL	Sysmon EventID 1, Windows Event Log Security 4688, CrowdStrike ProcessRollup2	T1564.004
Windows Wermgr Alternate Data Stream in Temp Dir	Anomaly	NULL	Sysmon EventID 15	T1564.004

Sub-techniques14

ID	Name	Examples
T1564.001	Hidden Files and Directories	60
T1564.002	Hidden Users	3
T1564.003	Hidden Window	61
T1564.004	NTFS File Attributes	16
T1564.005	Hidden File System	6
T1564.006	Run Virtual Instance	3
T1564.007	VBA Stomping	0
T1564.008	Email Hiding Rules	3
T1564.009	Resource Forking	2
T1564.010	Process Argument Spoofing	2
T1564.011	Ignore Process Interrupts	9
T1564.012	File/Path Exclusions	1
T1564.013	Bind Mounts	1
T1564.014	Extended Attributes	0

Groups0

None recorded.

Software7

Campaigns0

None recorded.

Procedure examples7

Software7

Used by	Procedure example
MalwareBundlore	Bundlore uses the `mktemp` utility to make unique file and directory names for payloads, such as TMP_DIR=`mktemp -d -t x. 20 macOS Common Tools and Techniques
MalwareDarkTortilla	DarkTortilla has used `%HiddenReg%` and `%HiddenKey%` as part of its persistence via the Windows registry. Secureworks DarkTortilla Aug 2022
MalwareNOOPLDR	NOOPLDR can hide services used to aid execution. JPCERT MirrorFace JUL 2024
MalwareOSX/Shlayer	OSX/Shlayer has used the `mktemp` utility to make random and unique filenames for payloads, such as `export tmpDir="$(mktemp -d /tmp/XXXXXXXXXXXX)"` or `mktemp -t Installer`. 20 macOS Common Tools and Techniques Shlayer jamf gatekeeper bypass 2021 sentinelone shlayer to zshlayer
ToolRemcos	Remcos can modify file attributes to hide the file. Fortinet Remcos Campaign NOV 2024
MalwareTarrask	Tarrask is able to create “hidden” scheduled tasks by deleting the Security Descriptor (`SD`) registry value. Tarrask scheduled task
MalwareWarzoneRAT	WarzoneRAT can masquerade the Process Environment Block on a compromised host to hide its attempts to elevate privileges through `IFileOperation`. Check Point Warzone Feb 2020

References4

Cybereason OSX Pirrit Open source
Amit Serper. (2016). Cybereason Lab Analysis OSX.Pirrit. Retrieved December 10, 2021.
MalwareBytes ADS July 2015 Open source
Arntz, P. (2015, July 22). Introduction to Alternate Data Streams. Retrieved March 21, 2018.
Sofacy Komplex Trojan Open source
Dani Creus, Tyler Halfpop, Robert Falcone. (2016, September 26). Sofacy's 'Komplex' OS X Trojan. Retrieved July 8, 2017.
Sophos Ragnar May 2020 Open source
SophosLabs. (2020, May 21). Ragnar Locker ransomware deploys virtual machine to dodge security. Retrieved June 29, 2020.

Data from MITRE ATT&CK® (Enterprise). ATT&CK® is a registered trademark of The MITRE Corporation.