T1564.004 Hide Artifacts: NTFS File Attributes

Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. MITRE ATT&CK

23 programs on CmdID 14 Sigma rules T1564.004 on attack.mitre.org

Part of

MITRE ATT&CK

T1564Hide Artifacts

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highRun PowerShell Script from ADSSergey Soldatov, Kaspersky Lab, oscd.community · Windows

mediumPotential Hidden Directory Creation Via NTFS INDEX_ALLOCATION Stream - CLINasreddine Bencherchali (Nextron Systems), Scoubi (@ScoubiMtl) · Windows

mediumRemote File Download Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumUse NTFS Short Name in Command Linefrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumUse NTFS Short Name in Imagefrack113, Nasreddine Bencherchali (Nextron Systems) · Windows

mediumUse Short Name Path in Command Linefrack113, Nasreddine Bencherchali · Windows

mediumUse Short Name Path in Imagefrack113, Nasreddine Bencherchali · Windows

lowInsensitive Subfolder Search Via Findstr.EXEFurkan CALISKAN, @caliskanfurkan_, @oscd_initiative, Nasreddine Bencherchali (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

Set the hidden flag for a file on the page for chflags

chflags hidden path/to/fileIdentify

Unset the hidden flag for a file on the page for chflags

chflags nohidden path/to/fileIdentify

An example is here when CmdID’s reading of it names T1564.004: a Sigma rule it trips is tagged with it, or its abuse is documented as it.