T1083 File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. MITRE ATT&CK

8 programs on CmdID 19 Sigma rules T1083 on attack.mitre.org

Programs for it

documented by LOLBAS and GTFOBins, or named by its rules

aptits Sigma rules fileits Sigma rules findits Sigma rules flockits Sigma rules gccits Sigma rules niceits Sigma rules viits Sigma rules vimits Sigma rules

Sigma rules tagged with it

process creation, the highest levels first

criticalTurla Group Lateral MovementMarkus Neis · Windows

criticalWannaCry Ransomware ActivityFlorian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro · Windows

highHackTool - PCHunter ExecutionFlorian Roth (Nextron Systems), Nasreddine Bencherchali · Windows

highPUA - Seatbelt ExecutionNasreddine Bencherchali (Nextron Systems) · Windows

highShell Execution GCC - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux

highShell Execution via Find - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux

highShell Execution via Flock - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux

highShell Execution via Nice - LinuxLi Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.) · Linux

highVim GTFOBin Abuse - LinuxNasreddine Bencherchali (Nextron Systems), Luc Génaux · Linux

mediumPotential Discovery Activity Using Find - LinuxNasreddine Bencherchali (Nextron Systems) · Linux

mediumPotential Discovery Activity Using Find - MacOSNasreddine Bencherchali (Nextron Systems) · macOS

mediumPUA - TruffleHog ExecutionSwachchhanda Shrawan Poudel (Nextron Systems) · Windows

mediumPUA - TruffleHog Execution - LinuxSwachchhanda Shrawan Poudel (Nextron Systems) · Linux

mediumShell Invocation via Apt - LinuxNasreddine Bencherchali (Nextron Systems) · Linux

lowCapabilities Discovery - LinuxNasreddine Bencherchali (Nextron Systems) · Linux

lowDirLister Executionfrack113 · Windows

lowNotepad Password Files DiscoveryThe DFIR Report · Windows

informationalFile and Directory Discovery - LinuxDaniil Yugoslavskiy, oscd.community, CheraghiMilad · Linux

informationalFile and Directory Discovery - MacOSDaniil Yugoslavskiy, oscd.community · macOS

Command lines CmdID reads as it

everyday examples from tldr-pages, CC BY 4.0

Copy all files and directories in a directory and add them onto an archive (copy-out), in verbose mode on the page for cpio

find path/to/directory | cpio [-ov|--create --verbose] >archive.cpioIdentify

Find files by extension on the page for find

find path/to/directory -name '*.ext'Identify

Find files matching multiple path/name patterns on the page for find

find path/to/directory -path '*/path/*/*.ext' -or -name '*pattern*'Identify

Find directories matching a given name, in case-insensitive mode on the page for find

find path/to/directory -type d -iname '*lib*'Identify

Start fzf on all files in the specified directory on the page for fzf

find path/to/directory -type f | fzfIdentify

Select multiple files with <Shift Tab> and write to a file on the page for fzf

find path/to/directory -type f | fzf --multi >path/to/fileIdentify

Test all PPD files under the current directory, printing the names of each file that does not conform on the page for cupstestppd

find . -name \*.ppd \! -execdir cupstestppd -q '{}' \; -printIdentify

Rebuild the project if source files change, limiting output to the first few lines on the page for entr

find src/ | entr -s 'make | sed 10q'Identify

List all mounted filesystems on the page for findmnt

findmntIdentify

Search for a device on the page for findmnt

findmnt /dev/sdb1Identify

Search for a mountpoint on the page for findmnt

findmnt /Identify

Find filesystems in specific type on the page for findmnt

findmnt --types ext4,virtiofs,btrfs,...Identify

And 34 more examples on CmdID’s program pages.

An example is here when CmdID’s reading of it names T1083: a Sigma rule it trips is tagged with it, or its abuse is documented as it.