File and Directory Discovery (T1083) is the step where an intruder looks around the file system to find what is worth taking. It is a discovery technique and applies to ESXi, Linux, macOS, Network Devices and Windows.
How attackers use it
MITRE says adversaries may enumerate files and directories, or search specific locations on a host or network share for certain information. The results may shape follow-on behavior, including whether the adversary fully infects the target or tries specific actions.
Many shell utilities can do it: dir, tree, ls, find and locate. Custom tools may call the native API. On network devices, the CLI offers commands such as dir, show flash and nvram. Some locations need elevated or specific permissions.
How to detect it
MITRE notes that the technique cannot be easily mitigated with preventive controls, since it abuses system features. Its detection strategy (DET0370) points to context:
- Windows: dir or tree run from non-standard processes or unusual user contexts, then recursive traversal or access to sensitive locations.
- Linux: ls, find or locate run by suspicious users or scripts that touch broad file hierarchies or restricted directories.
- macOS: discovery commands run from terminal or script tooling, especially outside normal user workflows.
- ESXi: esxcli commands that enumerate datastores, configuration files or directory structures, run by unauthorized or remote users.
- Network devices: dir, show flash or nvram commands from CLI sessions, especially by unauthorized users or from abnormal source IPs.
Enumeration is noisy at scale. A process that lists thousands of directories in seconds, especially under an account that normally does not, is the pattern to flag.
How to reduce the risk
Prevention is limited, but you can shrink what discovery finds. Keep sensitive data in few places, under tight file permissions, and log access to them. Record command line activity on servers and network devices so that unusual listing can be reconstructed afterwards.
Quick check
Why is a single directory listing a weak detection signal?
Administrators and software do it constantly. The signal is the context: unusual process, user or source, and broad recursive traversal.
Sources
- MITRE ATT&CK, T1083 File and Directory Discovery: https://attack.mitre.org/techniques/T1083/
