Ordinary tools can only inspect the file system they know about. Hidden File System (T1564.005) is a Stealth technique for Linux, macOS and Windows, and a subtechnique of Hide Artifacts.
How attackers use it
MITRE explains that file systems provide a structure for storing and accessing data, abstracting away its physical location. Standard file systems include FAT, NTFS, ext4 and APFS, and they can contain other structures such as the Volume Boot Record (VBR) and the Master File Table (MFT).
Adversaries may use their own abstracted, virtual file system, separate from the standard one on the infected system. That hides malicious components, and file input and output, from security tools. MITRE describes three ways it can be built:
- Storing a file system in reserved disk space not used by disk structures or standard partitions.
- Dropping a portable partition image as a file on top of the standard file system.
- Fragmenting files across the existing file system structure in non-standard ways.
How to detect it
MITRE's analytics, by platform:
- Windows. Creation or mounting of hidden partitions or virtual file systems, registry modifications linked to non-standard file systems, suspicious disk I/O patterns, and bootkit-like behavior where hidden volumes are reached outside normal file system APIs.
- Linux. Unusual mounting of loopback or pseudo file systems that do not fit legitimate administration. Monitor auditd and syslog for mount commands that involve suspicious mount points, reserved blocks or odd device mappings.
- macOS. Hidden partitions or APFS containers, anomalous use of hdiutil or diskutil to attach them, plist changes tied to system volumes, and raw disk access.
How to reduce the risk
MITRE does not list a mitigation for this subtechnique. Practical controls are to restrict who can mount file systems and attach disk images, keep a record of expected mounts per server role, and treat unexplained raw disk access as an investigation trigger.
Quick check
Name two ways MITRE says a hidden file system can be stored.
In reserved disk space outside standard partitions, or as a portable partition image placed on top of the standard file system.
