CyberStack

MITRE ATT&CK / Techniques / T1564

Hide Artifacts

ID
T1564
Tactics
TA0005 Stealth
Platforms
ESXi, Linux, macOS, Office Suite, Windows
Data sources
File Creation, Process Creation, Windows Registry Key Modification, Command Execution, File Metadata, Application Log Content
Source
attack.mitre.org
MITRE last modified
12 May 2026

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.[2][3][4]

Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.[5]

Sub-techniques (14)

Detection

Mitigations (4)

M1013 Application Developer Guidance

Application developers should consider limiting the requirements for custom or otherwise difficult to manage file/folder exclusions. Where possible, install applications to trusted system folder paths that are already protected by restricted file and directory permissions.

M1033 Limit Software Installation

Restrict the installation of software that may be abused to create hidden desktops, such as hVNC, to user groups that require it.

M1047 Audit

Periodically audit virtual machines for abnormalities.

M1049 Antivirus/Antimalware

Review and audit file/folder exclusions, and limit scope of exclusions to only what is required where possible.[1]

Software (7)

References

  1. Microsoft File Folder Exclusions
  2. Sofacy Komplex Trojan
  3. Cybereason OSX Pirrit
  4. MalwareBytes ADS July 2015
  5. Sophos Ragnar May 2020