T1083 File and Directory Discovery — Detection Rules

Source-backed rule directory

• Linux Capabilities Discovery · test · low · {"product":"linux","service":"auditd"}
• Shell Invocation via Apt - Linux · test · medium · {"category":"process_creation","product":"linux"}
• Capabilities Discovery - Linux · test · low · {"category":"process_creation","product":"linux"}
• File and Directory Discovery - Linux · test · informational · {"category":"process_creation","product":"linux"}
• Shell Execution via Find - Linux · test · high · {"category":"process_creation","product":"linux"}
• Shell Execution via Flock - Linux · test · high · {"category":"process_creation","product":"linux"}
• Shell Execution GCC - Linux · test · high · {"category":"process_creation","product":"linux"}
• Shell Execution via Nice - Linux · test · high · {"category":"process_creation","product":"linux"}
• PUA - TruffleHog Execution - Linux · experimental · medium · {"category":"process_creation","product":"linux"}
• Potential Discovery Activity Using Find - Linux · test · medium · {"category":"process_creation","product":"linux"}
• Vim GTFOBin Abuse - Linux · test · high · {"category":"process_creation","product":"linux"}
• File and Directory Discovery - MacOS · test · informational · {"category":"process_creation","product":"macos"}
• Potential Discovery Activity Using Find - MacOS · test · medium · {"category":"process_creation","product":"macos"}
• Cisco Discovery · test · low · {"product":"cisco","service":"aaa"}
• Source Code Enumeration Detection by Keyword · test · medium · {"category":"webserver"}
• Powershell Sensitive File Discovery · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• Powershell Directory Enumeration · test · medium · {"product":"windows","category":"ps_script","definition":"Requirements: Script Block Logging must be enabled"}
• DirLister Execution · test · low · {"category":"process_creation","product":"windows"}
• HackTool - PCHunter Execution · test · high · {"category":"process_creation","product":"windows"}
• Notepad Password Files Discovery · experimental · low · {"product":"windows","category":"process_creation"}
• PUA - Seatbelt Execution · test · high · {"category":"process_creation","product":"windows"}
• PUA - TruffleHog Execution · experimental · medium · {"category":"process_creation","product":"windows"}

Atlas deterministic concepts

T1083 File and Directory Discovery

COUNT(directory_listing_or_object_list BY actor, 5m) >= threshold -> ALERT

• File-System Activity Logs
• Cloud Object-Storage Access Logs
• Process Execution Logs
• Atlas source section

Anomaly models

No exact Atlas model in this snapshot.

ATT&CK analytic guidance

DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts

AN1040 Analytic 1040

Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.

AN1041 Analytic 1041

Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.

AN1042 Analytic 1042

Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.

AN1043 Analytic 1043

Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

AN1044 Analytic 1044

Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.