Clankerusecase
MITRE ATT&CK detection coverage
 ← Back to main site
Home/ MITRE Matrix/ Discovery/ T1083

T1083File and Directory Discovery

T1083 — File and Directory Discovery is a MITRE ATT&CK technique in the Discovery tactic. Clankerusecase tracks 27 detection use cases covering it and 26 threat-intel articles citing it.

Discovery
View on the matrix → Filter Detection Library MITRE official spec ↗
27Use cases
26Articles
0Sub-techniques
1Tactic

Use cases covering this technique (27)

Linux Auditd Database File And Directory Discovery ESCU actions · hunting P Linux Auditd File And Directory Discovery ESCU actions · hunting P Linux Auditd Hidden Files And Directories Creation ESCU actions · hunting P Linux Auditd Virtual Disk File And Directory Discovery ESCU actions · hunting P [LLM] Non-forensic process bulk-reading the App.MenuItem Biome stream Bespoke actions · hunting DSΣPDDCS [LLM] AI coding agent descendant reading developer credentials / env (Agentjacking credential access) Bespoke actions · hunting DSΣPDDCS [LLM] Web-facing exposure of dev.env / .env config file (returns 200) Bespoke recon · alerting DSΣPDDCSCW [LLM] Stata-authored log file written with shell metacharacters or path traversal in filename (CVE-2026-47708) Bespoke exploit · alerting DSΣPDDCS [LLM] Path-traversal exploit hitting Vitest /__vitest_attachment__ endpoint (CVE-2026-47429 PoC) Bespoke exploit · alerting DSΣPDDCS [LLM] Non-Codex-CLI node process reading ~/.codex/auth.json (Codex OAuth credential theft) Bespoke actions · alerting DSΣPDDCS [LLM] FileBrowser Quantum public share PATCH path traversal in fromPath/toPath (GHSA-qqqm-5547-774x) Bespoke exploit · alerting SPDD [LLM] Megalodon harvester: bash secret-grep across workspace (API_KEY|SECRET|TOKEN|PRIVATE_KEY|BEGIN RSA) Bespoke actions · hunting DSΣPDDCS [LLM] OCI image extraction creates symlink with absolute path target (CWE-61 primitive) Bespoke exploit · alerting DSΣPDDCS [LLM] Fission Function Name Enumeration via /fission-function/ Probing (CVE-2026-46614 recon) Bespoke recon · hunting SPDD [LLM] VS Code extension host fan-out reads of developer secrets (.ssh, .aws, .npmrc, ~/.claude/settings.json) Bespoke actions · hunting DSPDDCS [LLM] Burst credential-file harvest by VS Code / node process (Nx Console stealer behaviour) Bespoke actions · hunting DSPDDCS [LLM] Node.js process bulk-reading cloud & SCM credential files in single session Bespoke actions · hunting DSPDDCS [LLM] Node/npm/Bun process enumerating cloud, wallet, AI, and messaging credential file paths Bespoke actions · hunting DSPDDCS [LLM] Node.js postinstall reading .env / .env.* during package install Bespoke actions · alerting DSPDDCS [LLM] AI CLI weaponized for recon — claude/gemini/q invoked under npm install lineage Bespoke actions · alerting DSΣPDDCS [LLM] AI CLI tool (claude/gemini/q) spawned non-interactively by node/npm/npx for recon Bespoke actions · alerting DSΣPDDCS [LLM] TruffleHog secret-scanner execution on developer / CI host (SHA1-Hulud credential harvest) Bespoke actions · alerting DSΣPDDCS [LLM] TruffleHog secret-scanner executed by node/npm postinstall context Bespoke actions · alerting DSΣPDDCS [LLM] Postinstall node child enumerating multiple developer credential stores Bespoke actions · hunting DSPDDCS [LLM] AI coding agent CLI (claude/gemini/q) invoked with permission-bypass flags Bespoke actions · alerting DSΣPDDCS [LLM] Nx s1ngularity inventory file written to /tmp (inventory.txt / inventory.txt.bak) Bespoke actions · alerting DSΣPDDCS [LLM] Container PID 1 environment harvest via /proc/1/environ read Bespoke actions · hunting DSΣPDDCS

Articles citing this technique (26)

crit Tracing Digital Intent: New MacOS Tahoe 26 Artifact Discovered art-15
high Agentjacking Attack Tricks AI Coding Agents Into Running Malicious Code art-28
crit [GHSA / CRITICAL] CVE-2026-48031: Go Restful API Boilerplate: Hardcoded JWT Secret "random" Allows Token Forgery art-64
crit [GHSA / CRITICAL] CVE-2026-47708: MCP-for-Stata: Command injection via log_file_name parameter in Stata command wrapper art-122
crit [GHSA / CRITICAL] CVE-2026-47429: When Vitest UI server is listening, arbitrary file can be read and executed art-157
high Legitimate-Looking Codex Remote UI Secretly Steals Your AI Tokens art-194
crit [GHSA / CRITICAL] CVE-2026-48777: FileBrowser Quantum: Path traversal in public share PATCH allows file ops outside shared directory art-214
high Megalodon: Mass GitHub Actions Secret Exfiltration Across 5,500+ Public Repositories art-215
crit [GHSA / CRITICAL] CVE-2026-46703: Boxlite: Path Traversal Vulnerability Leads to Arbitrary File Write on the Host art-223
crit [GHSA / CRITICAL] CVE-2026-46614: Fission router exposes /fission-function/<ns>/<name> on its public listener, allowing invocation of any fu art-227
crit The Wild West of VS Code extensions and how a poisoned extension breached GitHub art-236
high GitHub breached via a malicious VS Code extension: why developer devices are the real target art-238
crit Active Supply Chain Attack: Malicious node-ipc Versions Published to npm art-269
crit TeamPCP's Mini Shai-Hulud Is Back: A Self-Spreading Supply Chain Attack Compromises TanStack npm Packages art-312
crit Inside AD CS Escalation: Unpacking Advanced Misuse Techniques and Tools art-316
crit A rigged game: ScarCruft compromises gaming platform in a supply-chain attack art-332
high Someone published four versions of a fake "tanstack" package in 27 minutes to steal your .env files art-346
high 10,000 Open-Source Projects Now Secured by Harden-Runner Community-Tier: A Milestone Three Years in the Making art-536
crit DynoWiper update: Technical analysis and attribution art-590
high 2025 in Review: The Evolution of Supply Chain Security & What's Next art-633
crit LongNosedGoblin tries to sniff out governmental affairs in Southeast Asia and Japan art-642
high SHA1-Hulud, npm supply chain incident art-686
crit Gotta fly: Lazarus targets the UAV sector art-734
high Zero-day Extensive NPM Package Compromise - Shai Hulud Supply Chain Attack art-789
high Weaponizing AI Coding Agents for Malware in the Nx Malicious Package Security Incident art-806
med Snyk Fetch the Flag CTF 2023 writeup: Protect The Environment art-1321