Hide Artifacts
Where this stands
A reviewer read the telemetry and concluded there is nothing here to detect that a sibling technique does not already cover.
Every observable in this brief is a named child's mechanism, and nothing parent-level is left after subtracting them. AN1384 (Windows) is three things: attrib.exe setting the hidden and system flags, and registry keys that alter file visibility (the Explorer Advanced\Hidden and ShowSuperHidden values), which are both exactly T1564.001 Hidden Files and Directories; and creation of Alternate Data Streams, which is exactly T1564.004 NTFS File Attributes. Both of those children still hold unauthored briefs in this corpus, so writing the rule here would file a child's detection under the parent tag and block the child from ever getting it — the same reason T1547 and T1546 were declined. […]
Covered instead by T1564.001, T1564.004, T1222.002, T1543.001.
What the technique is
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection. Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.
Read it on attack.mitre.orgWhat MITRE says you would watch
- AN1384
Abuse of file/registry attributes to hide malicious files, directories, or services. Defender view: detection of attrib.exe setting hidden/system flags, creation of Alternate Data Streams, or registry keys altering file visibility.
- AN1385
Hidden file creation using leading '.' or file attribute changes with chattr (immutable/hidden flags). Defender view: detect execution of chattr, lsattr anomalies, and unusual hidden files appearing in system directories.
- AN1386
Hidden files via 'chflags hidden' or Apple-specific attributes, LaunchAgents/LaunchDaemons placed in non-standard hidden directories. Defender view: detect command execution modifying file flags and unusual plist creation in hidden paths.
Technique names and descriptions © MITRE ATT&CK®, CC BY 4.0. Not endorsed by MITRE.