Operating systems hide things on purpose, to keep users from breaking them. Attackers use the same features to hide themselves. Hide Artifacts (T1564) is a Stealth technique, listed by MITRE for ESXi, Linux, macOS, Office Suite and Windows.
How attackers use it
MITRE explains that operating systems may have features to hide important system files and administrative task execution, to avoid disrupting user work environments and to stop users from changing files or features. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity.
They may also hide artifacts by creating computing regions that are isolated from common security instrumentation, such as through virtualization technology.
The subtechniques show the range: Hidden Files and Directories, Hidden Users, Hidden Window, NTFS File Attributes, Hidden File System, Run Virtual Instance, and VBA Stomping. Each has its own post in this series.
How to detect it
MITRE's detection strategy is organized by platform:
- Windows. attrib.exe setting hidden or system flags, creation of Alternate Data Streams, and registry keys that change file visibility.
- Linux. Hidden file creation with a leading dot, or attribute changes with chattr, and unusual hidden files in system directories.
- macOS. chflags hidden, and LaunchAgents or LaunchDaemons placed in non-standard hidden directories.
- ESXi. Abuse of the datastore or the ESXi shell to hide VM files, such as renaming or moving VMDK or VMX files into hidden directories.
- Office. Malicious macros or embedded objects hidden in documents by renaming streams or using hidden OLE objects.
How to reduce the risk
MITRE lists four mitigations.
- Limit software installation. Restrict installation of software that can create hidden desktops, such as hVNC, to the user groups that need it.
- Application developer guidance. Developers should limit requirements for custom or hard-to-manage file and folder exclusions where possible, and install applications to trusted system folder paths that are already protected by restricted permissions.
- Audit. Periodically audit virtual machines for abnormalities.
- Antivirus and antimalware. Review and audit file and folder exclusions, and limit the scope of exclusions to only what is needed.
Exclusions are a quiet risk. Every folder excluded from scanning is a place where hiding is free.
A mental model for the whole family
The Hide Artifacts subtechniques split into three kinds of hiding.
- Hidden from the user. Files with hidden flags, users removed from the login screen, and windows that never appear. The system still shows them to anyone who asks properly.
- Hidden from tools. Data in NTFS streams, VBA source replaced while p-code remains, and a separate file system the OS does not see. These beat scanners that read one layer.
- Hidden from the host. A virtual machine runs its own operating system out of reach of the host's security software.
The first kind is beaten by asking for everything: show hidden, list all accounts, enumerate streams. The second is beaten by inspecting more than one layer. The third is beaten by inventory and by watching the host for virtualization activity. If you can say which of these you can already do, you know where the gaps are.
Check your own environment
- What folders and processes are excluded from your antivirus, and who approved each one?
- Does your inventory of virtual machines match what is running on each host?
- Who can install remote desktop or VNC software on endpoints?
- Do your logs record file attribute changes and hidden user creation?
Quick check
Why does MITRE tell antivirus owners to audit exclusions?
Excluded folders are not scanned, so they are a ready-made hiding place for adversaries.
