Home/ MITRE Matrix/ Defense Evasion/ T1564.001

T1564.001Hidden Files and Directories

T1564.001 — Hidden Files and Directories is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 13 detection use cases covering it and 7 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

13Use cases

7Articles

0Sub-techniques

1Tactic

↑ Parent technique: T1564 · Hide Artifacts

Use cases covering this technique (13)

Disable Show Hidden Files ESCU actions · hunting P MacOS Hidden Files and Directories ESCU actions · hunting P Reg exe used to hide files directories via registry keys ESCU actions · alerting P [LLM] PHP CLI drops hidden /tmp dropper artefacts (Laravel-Lang autoload payload) Bespoke install · alerting DSΣPDDCS [LLM] Orphaned process (ppid=1) executing from /tmp hidden hex path (post-dropper stage-2) Bespoke actions · alerting DSΣPDDCS [LLM] node.exe spawns detached child from tmpdir after npm install (moika.tech dropper) Bespoke install · hunting DSPDDCS [LLM] PowerShower dropped to user Pictures folder as googleearth.ps1 Bespoke install · alerting DSΣPDDCS [LLM] Hidden .fullgc cryptominer binary written to /ql/data/db/ Bespoke install · alerting DSΣPDDCS [LLM] Qinglong .fullgc cryptominer execution with nohup backgrounding Bespoke install · alerting DSΣPDDCS [LLM] Stage-2 implant masquerading as node-health-check daemon (/tmp/.kh, /tmp/.ns) Bespoke install · alerting DSΣPDD [LLM] plain-crypto-js setup.js self-deletion or package.json overwrite (anti-forensics) Bespoke actions · hunting DSΣPDDCS [LLM] Linux Python RAT orphaned via nohup python3 /tmp/ld.py (Axios npm payload) Bespoke install · alerting DSΣPDDCS [LLM] macOS Axios RAT daemon spoof + ad-hoc codesign of hidden /private/tmp binary Bespoke install · alerting DSΣPDDCS

Articles citing this technique (7)

high Laravel-Lang Supply Chain Attack: Every Tag Across Multiple Composer Packages Rewritten to Steal CI Secrets art-145

crit Malicious npm packages abuse dependency confusion to profile developer environments art-161

crit Cloud Atlas activity in the second half of 2025 and early 2026: new tools and a new payload art-219

high Qinglong task scheduler RCE vulnerabilities exploited in the wild for cryptomining art-353

high GPT-Proxy Backdoor in npm and PyPI turns Servers into Chinese LLM Relays art-367

crit axios Compromised on npm - Malicious Versions Drop Remote Access Trojan art-401

high Axios npm Package Compromised: Supply Chain Attack Delivers Cross-Platform RAT art-420