T1564 Hide Artifacts

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. MITRE ATT&CK

3 programs on CmdID 5 Sigma rules T1564 on attack.mitre.org

Its sub-techniques

MITRE ATT&CK

T1564.001Hide Artifacts: Hidden Files and Directories

T1564.002Hide Artifacts: Hidden Users

T1564.003Hide Artifacts: Hidden Window

T1564.004Hide Artifacts: NTFS File Attributes

T1564.006Hide Artifacts: Run Virtual Instance

documented by LOLBAS and GTFOBins, or named by its rules

process creation, the highest levels first

highPotentially Suspicious Execution From Parent Process In Public FolderFlorian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems) · Windows

mediumMount Execution With Hidepid ParameterJoseliyo Sanchez, @Joseliyo_Jstnk · Linux

mediumPUA - Process Hacker ExecutionFlorian Roth (Nextron Systems) · Windows

mediumPUA - System Informer ExecutionFlorian Roth (Nextron Systems) · Windows

everyday examples from tldr-pages, CC BY 4.0

Start a virtual machine on the page for virtualboxvm

virtualboxvm --startvm nameIdentify

Start a virtual machine in fullscreen mode on the page for virtualboxvm

virtualboxvm --startvm name --fullscreenIdentify

Mount the specified DVD image file on the page for virtualboxvm

virtualboxvm --startvm name --dvd path\to\image_fileIdentify

Display a command-line window with debug information on the page for virtualboxvm

virtualboxvm --startvm name --debug-command-lineIdentify

Start a virtual machine in a paused state on the page for virtualboxvm

virtualboxvm --startvm name --start-pausedIdentify

An example is here when CmdID’s reading of it names T1564: a Sigma rule it trips is tagged with it, or its abuse is documented as it.