Esc

Hidden File System - T1564.005

(ATT&CK® Technique)

Definition

Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.

D3FEND Inferred Relationships

Browse the D3FEND knowledge graph by clicking on the nodes below.

        graph LR;

     T1564005["Hidden File System"] --> |may-modify| SystemConfigurationDatabase["System Configuration Database"]; class T1564005 OffensiveTechniqueNode;
        class SystemConfigurationDatabase ArtifactNode; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase";
        click T1564005 href "/offensive-technique/attack/T1564.005/"; click SystemConfigurationDatabase href "/dao/artifact/d3f:SystemConfigurationDatabase"; T1564005["Hidden File System"] --> |modifies| Storage["Storage"]; class T1564005 OffensiveTechniqueNode;
        class Storage ArtifactNode; click Storage href "/dao/artifact/d3f:Storage";
        click T1564005 href "/offensive-technique/attack/T1564.005/"; click Storage href "/dao/artifact/d3f:Storage";                          RestoreDatabase["Restore Database"] -->
          | restores | SystemConfigurationDatabase["System Configuration Database"];

          RestoreDatabase["Restore Database"] -.->
            | may-restore | T1564005["Hidden File System"] ;
          class RestoreDatabase DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click RestoreDatabase href "/technique/d3f:RestoreDatabase";            DiskEncryption["Disk Encryption"] -->
          | encrypts | Storage["Storage"];

          DiskEncryption["Disk Encryption"] -.->
            | may-harden | T1564005["Hidden File System"] ;
          class DiskEncryption DefensiveTechniqueNode;
          class Storage ArtifactNode;
          click DiskEncryption href "/technique/d3f:DiskEncryption"; SystemConfigurationPermissions["System Configuration Permissions"] -->
          | restricts | SystemConfigurationDatabase["System Configuration Database"];

          SystemConfigurationPermissions["System Configuration Permissions"] -.->
            | may-harden | T1564005["Hidden File System"] ;
          class SystemConfigurationPermissions DefensiveTechniqueNode;
          class SystemConfigurationDatabase ArtifactNode;
          click SystemConfigurationPermissions href "/technique/d3f:SystemConfigurationPermissions";

json