1200KM / detection
T1564.001 Hidden Files and Directories — Detection Rules
Detection workspace for T1564.001 Hidden Files and Directories: 7 Sigma sources, 0 Atlas concepts and 0 anomaly models. No live detection validation.
Source-backed rule directory
- Hidden Files and Directories · test · low · {"product":"linux","service":"auditd"}
- Hiding Files with Attrib.exe · test · medium · {"category":"process_creation","product":"windows"}
- Set Suspicious Files as System Files Using Attrib.EXE · test · high · {"category":"process_creation","product":"windows"}
- Use Icacls to Hide File to Everyone · test · medium · {"category":"process_creation","product":"windows"}
- Registry Persistence via Service in Safe Mode · test · high · {"category":"registry_set","product":"windows"}
- Displaying Hidden Files Feature Disabled · test · medium · {"category":"registry_set","product":"windows"}
- PowerShell Logging Disabled Via Registry Key Tampering · test · high · {"category":"registry_set","product":"windows"}
Atlas deterministic concepts
No exact concept selected.
Anomaly models
No exact Atlas model in this snapshot.
ATT&CK analytic guidance
DET0032 Detection Strategy for Hidden Files and Directories
AN0091 Analytic 0091
Suspicious use of attrib.exe or PowerShell commands to set hidden attributes on files/directories. Defender view: processes modifying file attributes to 'hidden' or creating files with ADS (alternate data streams).
AN0092 Analytic 0092
Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.
AN0093 Analytic 0093
Use of chflags hidden or SetFile -a V commands to hide files, or creation of hidden files with leading '.'. Defender view: monitoring process execution and file metadata changes setting UF_HIDDEN attribute.
Connected ecosystem references
Linked tags
Simulation, tools and telemetry
Threat actor context
These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.
Existing anomaly research
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.