T1564 — Hide Artifacts
Parent technique
Description
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.
Sub-techniques
- T1564.001 — Hidden Files and Directories
- T1564.002 — Hidden Users
- T1564.003 — Hidden Window
- T1564.004 — NTFS File Attributes
- T1564.005 — Hidden File System
- T1564.006 — Run Virtual Instance
- T1564.007 — VBA Stomping
- T1564.008 — Email Hiding Rules
- T1564.009 — Resource Forking
- T1564.010 — Process Argument Spoofing
- T1564.011 — Ignore Process Interrupts
- T1564.012 — File/Path Exclusions
- T1564.013 — Bind Mounts
- T1564.014 — Extended Attributes
Detected by EasySIEM
This project's own SigmaHQ-derived detection pipeline tags every compiled rule with the ATT&CK technique(s) it maps to -- if a rule in your install covers this technique, it shows up automatically on your own Grafana Alerts dashboard's "Top ATT&CK Techniques" panel, no lookup needed. This page exists so a click from there always lands here on easysiem.com, not on attack.mitre.org.