T1083 File and Directory Discovery — Attack Simulation

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this…

Technique description

At least one platform-compatible Atomic procedure is documented. Individual review, lab prerequisites, and validation remain required.

Official ATT&CK definition · Detection rules and anomaly models

Documented simulation candidates

File and Directory Discovery (cmd.exe)
windows automated command_prompt
Procedure 0e36303b-6762-4500-b003-127743b80ba6; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Nix File and Directory Discovery 2
linux macos automated sh
Procedure 13c5e1ae-605b-46c4-a79f-db28c77ff24e; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
File and Directory Discovery (PowerShell)
windows automated powershell
Procedure 2158908e-b7ef-4c21-8a83-3ce4dd05a924; elevation not declared required; cleanup not declared. Not executed or individually validated.
Identifying Network Shares - Linux
linux automated sh
Procedure 361fe49d-0c19-46ec-a483-ccb92d38e88e; elevation not declared required; cleanup not declared. Not executed or individually validated.
ESXi - Enumerate VMDKs available on an ESXi Host
windows automated command_prompt
Procedure 4a233a40-caf7-4cf1-890a-c6331bbc72cf; elevation not declared required; cleanup not declared. Not executed or individually validated.
Recursive Enumerate Files And Directories By Powershell
windows automated powershell
Procedure 95a21323-770d-434c-80cd-6f6fbf7af432; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Launch DirLister Executable
windows automated powershell
Procedure c5bec457-43c9-4a18-9a24-fe151d8971b7; elevation not declared required; cleanup not declared. Not executed or individually validated.
Simulating MAZE Directory Enumeration
windows automated powershell
Procedure c6c34f61-1c3e-40fb-8a58-d017d88286d8; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.
Nix File and Directory Discovery
linux macos automated sh
Procedure ffc8b249-372a-4b74-adcd-e4c0430842de; elevation not declared required; cleanup present, not reviewed. Not executed or individually validated.

Connected ecosystem references

Linked tags

enterprise cloud-hosted-endpoint network-infrastructure onprem virtualization ESXi Linux macOS Network Devices Windows discovery isolated_authorized_lab procedure_review_required telemetry_configuration_required

can_simulate technique source_mapped

Detection and collection

T1083 detection workspace

Attack tools

Threat actor context

These are explicit actor-to-technique associations in the existing Threat Matrix snapshot, not attribution of an event or proof that a detector identifies the actor. No tool-to-actor relationship is inferred.

Existing research

Threat Matrix: knowledge routes, evidence and actor context

Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.