Home/ MITRE Matrix/ Defense Evasion/ T1564

T1564Hide Artifacts

T1564 — Hide Artifacts is a MITRE ATT&CK technique in the Defense Evasion tactic. Clankerusecase tracks 3 detection use cases covering it and 2 threat-intel articles citing it.

Defense Evasion

View on the matrix → Filter Detection Library MITRE official spec ↗

3Use cases

2Articles

14Sub-techniques

1Tactic

Sub-techniques (14)

T1564.013 · Bind Mounts T1564.008 · Email Hiding Rules T1564.014 · Extended Attributes T1564.012 · File/Path Exclusions T1564.005 · Hidden File System T1564.001 · Hidden Files and Directories T1564.002 · Hidden Users T1564.003 · Hidden Window T1564.011 · Ignore Process Interrupts T1564.004 · NTFS File Attributes T1564.010 · Process Argument Spoofing T1564.009 · Resource Forking T1564.006 · Run Virtual Instance T1564.007 · VBA Stomping

Use cases covering this technique (3)

Windows New Deny Permission Set On Service SD Via Sc.EXE ESCU actions · hunting P Windows New Service Security Descriptor Set Via Sc.EXE ESCU actions · hunting P [LLM] Tengu immutable-binary persistence via chattr +i on Linux/IoT Bespoke install · hunting DSΣPDDCS

Articles citing this technique (2)

high Tengu Botnet Reboots Compromised Linux Devices When Defenders Kill Its Process art-43

crit Sednit reloaded: Back in the trenches art-596