attack.t1564.001

Atomic MacOS Stealer - Persistence Indicators

Apr 28, 2026 · attack.persistence attack.privilege-escalation attack.stealth attack.t1564.001 attack.t1543.004 detection.emerging-threats ·

Share on:

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

Displaying Hidden Files Feature Disabled

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

Hidden Files and Directories

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

Hiding Files with Attrib.exe

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detects usage of attrib.exe to hide files from users.

PowerShell Logging Disabled Via Registry Key Tampering

Apr 28, 2026 · attack.stealth attack.defense-impairment attack.t1564.001 attack.t1112 attack.persistence ·

Share on:

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

Registry Persistence via Service in Safe Mode

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

Set Suspicious Files as System Files Using Attrib.EXE

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

Use Icacls to Hide File to Everyone

Apr 28, 2026 · attack.stealth attack.t1564.001 ·

Share on:

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files