Meta tags:

Headings (most frequently used words):

hide, artifacts, hidden, files, and, directories, procedure, examples, mitigations, detection, strategy, references, other, sub, techniques, of, 14,

Text of the page (most frequently used words):
the (77), #hidden (75), and (74), retrieved (74), files (43), has (37), 2020 (35), file (34), with (23), may (22), 2018 (21), malware (19), 2024 (19), attributes (18), august (17), 2021 (17), hide (17), directory (17), t1564 (17), directories (16), new (15), september (15), from (15), july (14), 2019 (14), february (14), can (14), november (13), 2022 (13), system (13), user (12), all (11), october (11), march (11), april (11), january (11), macos (11), users (11), set (11), folder (11), att (10), for (10), attrib (10), group (9), analysis (9), used (9), plugx (9), 2017 (9), windows (9), name (9), itself (9), detection (8), backdoor (8), june (8), 2025 (8), its (8), created (8), folders (8), 2026 (7), enterprise (7), data (7), threat (7), malicious (7), that (7), ability (7), modified (7), mobile (6), targets (6), compromised (6), teampcp (6), apt (6), uses (6), lazarus (6), view (6), named (6), them (6), store (6), use (5), ics (5), none (5), sub (5), techniques (5), mac (5), attack (5), osx (5), campaign (5), rat (5), government (5), mustang (5), panda (5), intelligence (5), darkgate (5), stealer (5), calisto (5), commands (5), also (5), leading (5), make (5), linux (5), victim (5), command (5), finder (5), mitre (4), are (4), software (4), research (4), team (4), ransomware (4), variant (4), tropic (4), trooper (4), infection (4), chain (4), rocke (4), security (4), december (4), redcurl (4), 2023 (4), private (4), under (4), platform (4), targeting (4), fin13 (4), cryptocurrency (4), cuckoo (4), app (4), carberp (4), wannacry (4), using (4), process (4), attribute (4), exe (4), random (4), library (4), create (4), default (4), ssh (4), tmp (4), version (4), artifacts (4), cti (3), components (3), strategies (3), mitigations (3), defenses (3), xcsset (3), day (3), wastedlocker (3), strategy (3), transparent (3), tribe (3), part (3), updates (3), sysupdate (3), cyber (3), report (3), trojan (3), slothfulmedia (3), evade (3), cloud (3), defense (3), uncovering (3), operations (3), chinese (3), reddelta (3), via (3), qakbot (3), poetrat (3), target (3), conflict (3), shlayer (3), hromcova (3), okrum (3), netwire (3), micropsia (3), macspy (3), service (3), machete (3), institutions (3), luminousmoth (3), attacks (3), loudminer (3), lokibot (3), ixeshe (3), invisimole (3), fin7 (3), dacls (3), coathanger (3), backconfig (3), following (3), attor (3), applejeus (3), agent (3), tesla (3), komplex (3), defender (3), technique (3), copy (3), not (3), installation (3), explorer (3), payload (3), application (3), local (3), 001 (3), adversaries (3), these (3), line (3), 2015 (2), corporation (2), domains (2), resources (2), reference (2), campaigns (2), groups (2), analytics (2), assets (2), tactics (2), matrices (2), core (2), objects (2), response (2), code (2), into (2), xcode (2), leverages (2), zero (2), horejsi (2), patrick (2), wardle (2), persistence (2), more (2), github (2), lunghi (2), cisa (2), mar (2), remote (2), evolves (2), sherstobitoff (2), operation (2), global (2), infrastructure (2), espionage (2), targeted (2), taiwan (2), asia (2), about (2), open (2), black (2), mercer (2), python (2), public (2), unit (2), against (2), oceanlotus (2), found (2), activity (2), old (2), tricks (2), blog (2), cross (2), mining (2), infostealer (2), north (2), korea (2), update (2), latest (2), center (2), microsoft (2), capability (2), stokes (2), apple (2), like (2), between (2), thomas (2), reed (2), installs (2), dutch (2), military (2), south (2), falcone (2), based (2), chflags (2), creation (2), monitoring (2), uf_hidden (2), bin (2), logs (2), analytic (2), description (2), this (2), copied (2), system32 (2), location (2), programdata (2), hides (2), thiefquest (2), home (2), hosts (2), period (2), visible (2), which (2), modify (2), rising (2), sun (2), reptile (2), stored (2), added (2), quasarrat (2), sets (2), osx_oceanlotus (2), before (2), exfiltration (2), outputs (2), usb (2), drives (2), executables (2), creates (2), vba (2), dot (2), prefix (2), imminent (2), monitor (2), saves (2), ikitten (2), keys (2), hiupan (2), host (2), hafnium (2), fruitfly (2), information (2), path (2), explosive (2), envyscout (2), after (2), machine (2), additionally (2), binary (2), info (2), plist (2), string (2), cointicker (2), clambling (2), standard (2), claimloader (2), systems (2), naming (2), current (2), ccf32 (2), apt32 (2), apt28 (2), terminal (2), character (2), being (2), seen (2), mark (2), specific (2), utilities (2), must (2), have (2), normal (2), show (2), when (2), gui (2), ckcon (2), person (2), tickets (2), faq (2), registered, trademarks, cookie, preferences, website, changelog, privacy, policy, terms, contact, reset, filters, inserts, projects, performs, uxss, planting, safari, two, exploits, antenucci, pantazopoulos, sandee, developed, evil, corp, chen, back, usbferry, air, gapped, environments, dedola, evolution, evilquest, uncovered, mccarthy, haughom, read, kics, action, strikes, again, supply, eriksen, popular, telnyx, package, pypi, iron, tiger, toolkit, evolved, dhs, national, mission, force, 10303705, access, xingyu, products, liebenberg, champion, monero, miners, malhotra, sharpshooter, critical, punsaen, boonyakarn, shawn, chew, logeswaran, nadarajan, mathew, potaczek, jakub, jozwiak, alex, marvi, cloaked, covert, unc3886, insikt, state, sponsored, mongolia, southeast, adapted, awakening, pentest, you, didn, know, ar18, 352a, quasar, source, administration, tool, kenefick, basta, gang, infiltrates, networks, brute, ratel, cobalt, strike, covid, lures, azerbaijan, sectors, secureworks, counter, bronze, president, officials, raggi, good, bad, web, bug, ta416, increases, operational, tempo, european, governments, ukraine, escalates, linked, carbon, discovered, ketrican, overview, recent, ke3chang, lambert, intro, alexandre, cote, cyr, hodur, korplug, hamzeloofard, wave, hong, kong, avira, tsarfaty, peter, ewane, eset, just, got, sharper, venezuelan, lechtik, etl, sweeping, chosen, few, malik, cracked, vst, hoang, elements, saini, hossein, client, resurfaces, banks, bitcoin, sancho, 2012, cherpanov, story, qianxin, continuous, colombian, corporations, lenart, bermejo, sunny, ted, lee, earth, preta, eoin, miller, defending, analyzing, attacker, behavior, post, exploitation, exchange, blackberry, automotive, industry, sygnia, incident, tg2003, elephant, beetle, organized, financial, theft, cybercriminal, actor, focused, mexico, volatile, cedar, mstic, breaking, down, nobelium, early, stage, toolset, adi, zeligson, rotem, kerner, enter, mabutas, shows, multi, four, distinct, families, ensuring, samples, rapidly, emerge, kohler, lopez, behaves, spyware, ticker, backdoors, mivd, general, aivd, ministry, netherlands, uncovers, stealthy, fortigate, drbcontrol, golo, muhr, joshua, chung, hive0154, philippines, pakistan, suspected, vrabie, dissecting, eastern, asian, trusteer, fraud, prevention, 2010, hood, configuration, pantig, kuzin, zelensky, hinchliffe, updated, organizations, levene, grunzweig, sure, take, combojack, alters, clipboards, steal, pal, crying, futile, sandblast, forensic, noerenberg, costis, quist, technical, divya, leveraging, autohotkey, teams, xelu86, tor, communications, meet, fantasy, creature, spy, dumont, decoy, document, real, cybersecurity, agency, walter, stay, top, claud, xiao, wirelurker, era, ios, antiquated, dani, creus, tyler, halfpop, robert, 2016, sofacy, references, setfile, execution, metadata, changes, setting, an0093, privileged, etc, var, usr, auditd, creations, where, begins, correlated, unusual, context, an0092, suspicious, powershell, processes, modifying, creating, ads, alternate, streams, an0091, det0032, type, cannot, easily, mitigated, preventive, controls, since, abuse, features, embed, git, xcassets, s0658, different, filename, appdata, s0612, some, s0366, documents, flash, g0081, legitimate, replace, copies, same, g0134, beginning, followed, characters, s0595, write, s9041, lock, establish, hour, cooldown, drops, installed, g1056, s0663, been, insure, s0533, downloaded, libprocesshider, could, g0106, s0448, communicate, kernel, mode, component, s1219, encrypted, payloads, associated, during, c0047, original, manipulating, victims, click, lnk, g1039, s0262, placed, subdirectories, s0650, unhide, s0428, characteristics, s0013, main, loader, s0352, executed, script, mounted, dmg, s0402, s0439, launch, s0198, collected, recycle, g0129, dedicated, each, s0339, stores, ds_stores, s0282, exfiltrate, stolen, removable, drive, s0409, binaries, g1014, virtualbox, vboxvmservice, parent, s0451, s0447, macro, g0032, shared, kextd, s0162, own, executable, s0015, s0260, dynamic, debugging, feature, s0434, s0278, registry, ensure, extensions, through, modification, hkcu, currentversion, advanced, s1230, g0125, s0277, g0046, within, gathered, g1016, commonly, s0569, s0634, initial, involves, dropping, several, rjtu, s1111, had, s0497, scraped, password, s1153, downloads, maintain, enc, server, launchagents, espl, containers, s0369, s1105, s0660, remain, s1236, time, year, month, s1043, startup, s0484, s0274, s0475, s1176, log, archive, combination, those, s0438, clientid, function, g0050, saved, g0007, filenames, unlisting, listings, s0584, s0331, procedure, examples, live, permalink, last, ve_rose, tcpdump101, com, bsky, contributors, platforms, stealth, tactic, their, advantage, anywhere, evading, typical, does, incorporate, investigation, manner, would, allow, such, only, space, marked, flag, prevents, but, still, allows, many, applications, doesn, clutter, workspace, example, contains, known, simply, putting, first, start, viewed, specifically, change, settings, viewable, mechanisms, prevent, accidentally, changing, special, most, operating, concept, don, browses, explicitly, ask, either, series, graphical, interface, prompts, switches, dir, extended, 014, bind, mounts, 013, exclusions, 012, ignore, interrupts, 011, argument, spoofing, 010, resource, forking, 009, email, hiding, rules, 008, stomping, 007, run, virtual, instance, 006, 005, ntfs, 004, window, 003, 002, other, join, mclean, hotel, details, register, here, search, contribute, benefactors, legal, branding, history, engage, tools, advisory, council, learn, get, started, detections,

Text of the page (random words):
and directories t1564 002 hidden users t1564 003 hidden window t1564 004 ntfs file attributes t1564 005 hidden file system t1564 006 run virtual instance t1564 007 vba stomping t1564 008 email hiding rules t1564 009 resource forking t1564 010 process argument spoofing t1564 011 ignore process interrupts t1564 012 file path exclusions t1564 013 bind mounts t1564 014 extended attributes adversaries may set files and directories to be hidden to evade detection mechanisms to prevent normal users from accidentally changing special files on a system most operating systems have the concept of a hidden file these files don t show up when a user browses the file system with a gui or when using normal commands on the command line users must explicitly ask to show the hidden files either via a series of graphical user interface gui prompts or with command line switches dir a for windows and ls a for linux and macos on linux and mac users can mark specific files as hidden simply by putting a as the first character in the file or folder name 1 2 files and folders that start with a period are by default hidden from being viewed in the finder application and standard command line utilities like ls users must specifically change settings to have these files viewable files on macos can also be marked with the uf_hidden flag which prevents them from being seen in finder app but still allows them to be seen in terminal app 3 on windows users can mark specific files as hidden by using the attrib exe binary many applications create these hidden files and folders to store information so that it doesn t clutter up the user s workspace for example ssh utilities create a ssh folder that s hidden and contains the user s known hosts and keys additionally adversaries may name files in a manner that would allow the file to be hidden such as naming a file only a space character adversaries can use this to their advantage to hide files and folders anywhere on the system and evading a typical user or system analysis that does not incorporate investigation of hidden files id t1564 001 sub technique of t1564 ⓘ tactic stealth ⓘ platforms linux windows macos contributors gr ve_rose tcpdump101 com on bsky version 2 0 created 26 february 2020 last modified 12 may 2026 version permalink live version procedure examples id name description s0331 agent tesla agent tesla has created hidden folders 4 s0584 applejeus applejeus has added a leading to plist filenames unlisting them from the finder app and default terminal directory listings 5 g0007 apt28 apt28 has saved files with hidden file attributes 6 6 g0050 apt32 apt32 s macos backdoor hides the clientid file via a chflags function 7 s0438 attor attor can set attributes of log files and directories to hidden system archive or a combination of those 8 s1176 attrib attrib can be used to make files or directories hidden 9 10 11 12 13 s0475 backconfig backconfig has the ability to set folders or files to be hidden from the windows explorer default view 14 s0274 calisto calisto uses a hidden directory named calisto to store data from the victim s machine before exfiltration 15 16 s0484 carberp carberp has created a hidden file in the startup folder of the current user 17 s1043 ccf32 ccf32 has created a hidden directory on targeted systems naming it after the current local time year month and day 18 s1236 claimloader claimloader has modified file attributes to remain hidden to a standard user 19 s0660 clambling clambling has the ability to set its file attributes to hidden 20 s1105 coathanger coathanger creates and installs itself to a hidden installation directory 21 s0369 cointicker cointicker downloads the following hidden files to evade detection and maintain persistence private tmp info enc private tmp info py private tmp server sh library launchagents espl plist library containers random string random string 22 s1153 cuckoo stealer cuckoo stealer has copied its binary and the victim s scraped password into a hidden folder in the users directory 23 24 s0497 dacls dacls has had its payload named with a dot prefix to make it hidden from view in the finder application 25 26 s1111 darkgate darkgate initial installation involves dropping several files to a hidden directory named after the victim machine name 27 additionally darkgate uses attrib to hide a directory in the following command c windows system32 attrib exe h c rjtu 10 s0634 envyscout envyscout can use hidden directories and files to hide malicious executables 28 s0569 explosive explosive has commonly set file and path attributes to hidden 29 g1016 fin13 fin13 has created hidden files and folders within a compromised linux system tmp directory fin13 also has used attrib exe to hide gathered local host information 30 31 g0046 fin7 fin7 has used attrib h c programdata ssh to make the ssh folder hidden 32 s0277 fruitfly fruitfly saves itself with a leading to make it a hidden file 33 g0125 hafnium hafnium has hidden files on a compromised host 34 s1230 hiupan hiupan has modified registry keys to ensure hidden files and extensions are not visible through the modification of hkcu software microsoft windows currentversion explorer advanced 19 35 s0278 ikitten ikitten saves itself with a leading so that it s hidden from users by default 33 s0434 imminent monitor imminent monitor has a dynamic debugging feature to set the file attribute to hidden 36 s0260 invisimole invisimole can create hidden system directories 37 s0015 ixeshe ixeshe sets its own executable file s attributes to hidden 38 s0162 komplex the komplex payload is stored in a hidden directory at users shared local kextd 1 g0032 lazarus group lazarus group has used a vba macro to set its file attributes to system and hidden and has named files with a dot prefix to hide them from the finder application 39 25 26 40 s0447 lokibot lokibot has the ability to copy itself to a hidden file and directory 41 s0451 loudminer loudminer has set the attributes of the virtualbox directory and vboxvmservice parent directory to hidden 42 g1014 luminousmoth luminousmoth has used malware to store malicious binaries in hidden directories on victim s usb drives 43 s0409 machete machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive 44 s0282 macspy macspy stores itself in library ds_stores 45 s0339 micropsia micropsia creates a new hidden directory to store all components outputs in a dedicated sub folder for each 46 g0129 mustang panda mustang panda s plugx variant has created a hidden folder on usb drives named recycle bin to store malicious executables and collected data 47 mustang panda has also modified file attributes to hidden and system 48 s0198 netwire netwire can copy itself to and launch itself from hidden folders 49 s0439 okrum before exfiltration okrum s backdoor has used hidden files to store logs and outputs from backdoor commands 50 s0402 osx shlayer osx shlayer has executed a command script from a hidden directory in a mounted dmg 51 s0352 osx_oceanlotus d osx_oceanlotus d sets the main loader file s attributes to hidden 52 s0013 plugx plugx can modify the characteristics of folders to hide them from the compromised user 53 plugx has also modified file attributes to hidden and system 48 54 s0428 poetrat poetrat has the ability to hide and unhide files 55 s0650 qakbot qakbot has placed its payload in hidden subdirectories 56 s0262 quasarrat quasarrat has the ability to set file attributes to hidden to hide files from the compromised user s view in windows file explorer 57 g1039 redcurl redcurl added the hidden file attribute to original files manipulating victims to click on malicious lnk files 58 59 c0047 reddelta modified plugx infection chain operations mustang panda stored encrypted payloads associated with plugx installation in hidden directories during reddelta modified plugx infection chain operations 60 s1219 reptile reptile has the ability to communicate with the kernel mode component to hide files 61 s0448 rising sun rising sun can modify file attributes to hide files 62 g0106 rocke rocke downloaded a file libprocesshider which could hide files on the target system 63 64 s0533 slothfulmedia slothfulmedia has been created with a hidden attribute to insure it s not visible to the victim 65 s0663 sysupdate sysupdate has the ability to set file attributes to hidden 66 g1056 teampcp teampcp has used a hidden lock file to establish a 12 hour cooldown period between re drops for installed malware 67 s9041 teampcp cloud stealer teampcp cloud stealer can create a hidden directory in the user s home folder on linux hosts to write a python backdoor 68 s0595 thiefquest thiefquest hides a copy of itself in the user s library directory by using a at the beginning of the file name followed by 9 random characters 69 g0134 transparent tribe transparent tribe can hide legitimate directories and replace them with malicious copies of the same name 70 g0081 tropic trooper tropic trooper has created a hidden directory under c programdata apple updates and c users public documents flash 71 72 s0366 wannacry wannacry uses attrib h to make some of its files hidden 11 12 s0612 wastedlocker wastedlocker has copied a random file from the windows system32 folder to the appdata location under a different hidden filename 73 s0658 xcsset xcsset uses a hidden folder named xcassets and git to embed itself in xcode 74 mitigations this type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features detection strategy id name analytic id analytic description det0032 detection strategy for hidden files and directories an0091 suspicious use of attrib exe or powershell commands to set hidden attributes on files directories defender view processes modifying file attributes to hidden or creating files with ads alternate data streams an0092 creation of files or directories with a leading in privileged directories etc var usr bin defender view monitoring auditd logs for file creations where name begins with and correlated with unusual user process context an0093 use of chflags hidden or setfile a v commands to hide files or creation of hidden files with leading defender view monitoring process execution and file metadata changes setting uf_hidden attribute references dani creus tyler halfpop robert falcone 2016 september 26 sofacy s komplex os x trojan retrieved july 8 2017 thomas reed 2017 january 18 new mac backdoor using antiquated code retrieved july 5 2017 claud xiao n d wirelurker a new era in ios and os x malware retrieved july 10 2017 walter j 2020 august 10 agent tesla old rat uses new tricks to stay on top retrieved december 11 2020 cybersecurity and infrastructure security agency 2021 february 21 applejeus analysis of north korea s cryptocurrency malware retrieved march 1 2021 mercer w et al 2017 october 22 cyber conflict decoy document used in real cyber conflict retrieved november 2 2018 dumont r 2019 april 9 oceanlotus macos malware update retrieved april 15 2019 hromcova z 2019 october at commands tor based communications meet attor a fantasy creature and also a spy platform retrieved may 6 2020 xelu86 et al 2023 september 25 attrib retrieved november 22 2024 divya 2024 april 30 darkgate malware leveraging autohotkey following teams retrieved november 22 2024 noerenberg e costis a and quist n 2017 may 16 a technical analysis of wannacry ransomware retrieved december 8 2024 pal p 2017 may 16 crying is futile sandblast forensic analysis of wannacry retrieved november 22 2024 levene b grunzweig j 2018 march 5 sure i ll take that new combojack malware alters clipboards to steal cryptocurrency retrieved november 25 2024 hinchliffe a and falcone r 2020 may 11 updated backconfig malware targeting government and military organizations in south asia retrieved june 17 2020 kuzin m zelensky s 2018 july 20 calisto trojan for macos retrieved september 7 2018 pantig j 2018 july 30 osx calisto retrieved september 7 2018 trusteer fraud prevention center 2010 october 7 carberp under the hood of carberp malware configuration analysis retrieved july 15 2020 vrabie v 2020 november dissecting a chinese apt targeting south eastern asian government institutions retrieved september 19 2022 golo muhr joshua chung 2025 may 15 hive0154 targeting us philippines pakistan and taiwan in suspected espionage campaign retrieved august 4 2025 lunghi d et al 2020 february uncovering drbcontrol retrieved november 12 2021 dutch military intelligence and security service mivd dutch general intelligence and security service aivd 2024 february 6 ministry of defense of the netherlands uncovers coathanger a stealthy chinese fortigate rat retrieved february 7 2024 thomas reed 2018 october 29 mac cryptocurrency ticker app installs backdoors retrieved april 23 2019 kohler a and lopez c 2024 april 30 malware cuckoo behaves like cross between infostealer and spyware retrieved august 20 2024 stokes p 2024 may 9 macos cuckoo stealer ensuring detection and defense as new samples rapidly emerge retrieved august 20 2024 stokes p 2020 july 27 four distinct families of lazarus malware target apple s macos platform retrieved august 7 2020 mabutas g 2020 may 11 new macos dacls rat backdoor shows lazarus multi platform attack capability retrieved august 10 2020 adi zeligson rotem kerner 2018 november 13 enter the darkgate new cryptocurrency mining and ransomware campaign retrieved february 9 2024 mstic 2021 may 28 breaking down nobelium s latest early stage toolset retrieved august 4 2021 threat intelligence and research 2015 march 30 volatile cedar retrieved february 8 2021 ta v et al 2022 august 8 fin13 a cybercriminal threat actor focused on mexico retrieved february 9 2023 sygnia incident response team 2022 january 5 tg2003 elephant beetle uncovering an organized financial theft operation retrieved february 9 2023 the blackberry research and intelligence team 2024 april 17 threat group fin7 targets the u s automotive industry retrieved may 1 2025 patrick wardle n d mac malware of 2017 retrieved september 21 2018 eoin miller 2021 march 23 defending against the zero day analyzing attacker behavior post exploitation of microsoft exchange retrieved october 27 2022 lenart bermejo sunny lu ted lee 2024 september 9 earth preta evolves its attacks with new malware and strategies retrieved august 4 2025 qianxin threat intelligence center 2019 february 18 apt c 36 continuous attacks targeting colombian government institutions and corporations retrieved may 5 2020 hromcova z and cherpanov a 2020 june invisimole the hidden part of the story retrieved july 16 2020 sancho d et al 2012 may 22 ixeshe an apt campaign retrieved june 7 2019 sherstobitoff r 2018 february 12 lazarus resurfaces targets global banks and bitcoin users retrieved february 19 2018 saini a and hossein j 2022 january 27 north korea s lazarus apt leverages windows update client github in latest campaign retrieved janu...