attack.t1564.001

Hidden Files and Directories

Dec 8, 2025 · attack.defense-evasion attack.t1564.001 ·

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

PowerShell Logging Disabled Via Registry Key Tampering

Nov 26, 2025 · attack.defense-evasion attack.t1564.001 attack.t1112 attack.persistence ·

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Registry Persistence via Service in Safe Mode

Nov 26, 2025 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Atomic MacOS Stealer - Persistence Indicators

Nov 24, 2025 · attack.persistence attack.privilege-escalation attack.defense-evasion attack.t1564.001 attack.t1543.004 detection.emerging-threats ·

Share on:

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

Displaying Hidden Files Feature Disabled

Feb 3, 2025 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Hiding Files with Attrib.exe

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

Set Suspicious Files as System Files Using Attrib.EXE

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Use Icacls to Hide File to Everyone

Aug 12, 2024 · attack.defense-evasion attack.t1564.001 ·

Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files