File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.

Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. ^[1] Custom tools may also be used to gather file and directory information and interact with the Native API.

ID: T1083

Sub-techniques: No sub-techniques

Tactic: Discovery

Platforms: Linux, Windows, macOS

System Requirements: Some folders may require Administrator, SYSTEM or specific user depending on permission levels and access controls

Permissions Required: Administrator, SYSTEM, User

Data Sources: File monitoring, Process command-line parameters, Process monitoring

CAPEC ID: CAPEC-127, CAPEC-497

Version: 1.3

Created: 31 May 2017

Last Modified: 16 September 2020

Version Permalink

Live Version

Procedure Examples

Name	Description
3PARA RAT	3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.^[2]
4H RAT	4H RAT has the capability to obtain file and directory listings.^[2]
admin@338	admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: `dir c:\ >> %temp%\download` `dir "c:\Documents and Settings" >> %temp%\download` `dir "c:\Program Files\" >> %temp%\download` `dir d:\ >> %temp%\download`^[3]
ADVSTORESHELL	ADVSTORESHELL can list files and directories.^[4]^[5]
APT18	APT18 can list files information for specific directories.^[6]
APT28	APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.^[7]^[8]
APT3	APT3 has a tool that looks for files and directories on the local file system.^[9]^[10]
APT32	APT32's backdoor possesses the capability to list files and directories on a machine. ^[11]
APT41	APT41 has executed `file /bin/pwd` on exploited victims, perhaps to return architecture related information.^[12]
Aria-body	Aria-body has the ability to gather metadata from a file and to search for file and directory names.^[13]
Attor	Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.^[14]
AuditCred	AuditCred can search through folders and files on the system.^[15]
AutoIt backdoor	AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.^[16]
Avenger	Avenger has the ability to browse files in directories such as Program Files and the Desktop.^[17]
Azorult	Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.^[18]
BabyShark	BabyShark has used `dir` to search for "programfiles" and "appdata".^[19]
BackConfig	BackConfig has the ability to identify folders and files related to previous infections.^[20]
Backdoor.Oldrea	Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.^[21]
BACKSPACE	BACKSPACE allows adversaries to search for files.^[22]
BADNEWS	BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.^[23]
BadPatch	BadPatch searches for files with specific file extensions.^[24]
Bankshot	Bankshot searches for files on the victim's machine.^[25]
BBSRAT	BBSRAT can list file and directory information.^[26]
BLACKCOFFEE	BLACKCOFFEE has the capability to enumerate files.^[27]
BlackEnergy	BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.^[28]^[29]
Brave Prince	Brave Prince gathers file and directory information from the victim’s machine.^[30]
BRONZE BUTLER	BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.^[31]
Cannon	Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.^[32]
Cardinal RAT	Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).^[33]
ChChes	ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.^[34]
China Chopper	China Chopper's server component can list directory contents.^[35]
CHOPSTICK	An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.^[4]
cmd	cmd can be used to find files and directories with native functionality such as `dir` commands.^[36]
CookieMiner	CookieMiner has looked for files in the user's home directory with "wallet" in their name using `find`.^[37]
CORALDECK	CORALDECK searches for specified files.^[38]
CosmicDuke	CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.^[39]
CrackMapExec	CrackMapExec can discover specified filetypes and log files on a targeted system.^[40]
Crimson	Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.^[41]
CrossRAT	CrossRAT can list all files on a system.
Cryptoistic	Cryptoistic can scan a directory to identify files for deletion.^[42]
Dacls	Dacls can scan directories on a compromised host.^[43]
Dark Caracal	Dark Caracal collected file listings of all default Windows directories.^[44]
DDKONG	DDKONG lists files on the victim’s machine.^[45]
Denis	Denis has several commands to search directories for files.^[46]^[47]
Derusbi	Derusbi is capable of obtaining directory, file, and drive listings.^[48]^[35]
down_new	down_new has the ability to list the directories on a compromised host.^[17]
Dragonfly 2.0	Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.^[49]
Dust Storm	Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.^[50]
DustySky	DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.^[51]^[52]
Elise	A variant of Elise executes `dir C:\progra~1` when initially run.^[53]^[54]
ELMER	ELMER is capable of performing directory listings.^[55]
Empire	Empire includes various modules for finding files of interest on hosts and network shares.^[56]
Epic	Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.^[57]^[58]
FALLCHILL	FALLCHILL can search files on a victim.^[59]
FatDuke	FatDuke can enumerate directories on target machines.^[60]
FinFisher	FinFisher enumerates directories and scans for certain files.^[61]^[62]
FLASHFLOOD	FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.^[22]
Forfiles	Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)^[7]
FruitFly	FruitFly looks for specific files and file types.^[63]
Fysbis	Fysbis has the ability to search for files.^[64]
Gamaredon Group	Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.^[65]
GeminiDuke	GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.^[66]
Gold Dragon	Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.^[30]
GoldenSpy	GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.^[67]
GravityRAT	GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.^[68]
Honeybee	Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.^[69]
HOPLIGHT	HOPLIGHT has been observed enumerating system drives and partitions.^[70]
HotCroissant	HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.^[71]
HTTPBrowser	HTTPBrowser is capable of listing files, folders, and drives on a victim.^[72]^[73]
Hydraq	Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.^[74]^[75]
Imminent Monitor	Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.^[76]
Inception	Inception used a file listing plugin to collect information about file and directories both on local and remote drives.^[77]
InnaputRAT	InnaputRAT enumerates directories and obtains file attributes on a system.^[78]
InvisiMole	InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.^[79]
Ixeshe	Ixeshe can list file and directory information.^[80]
JPIN	JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.^[81]
jRAT	jRAT can browse file systems.^[82]^[83]
Kasidet	Kasidet has the ability to search for a given filename on a victim.^[84]
Kazuar	Kazuar finds a specified directory, lists the files and metadata about those files.^[85]
Ke3chang	Ke3chang uses command-line interaction to search files and directories.^[86]
KeyBoy	KeyBoy has a command to launch a file browser or explorer on the system.^[87]
KEYMARBLE	KEYMARBLE has a command to search for files on the victim’s machine.^[88]
Kimsuky	Kimsuky has the ability to enumerate all the drives on an infected system.^[89]
Kivars	Kivars has the ability to list drives on the infected host.^[90]
KONNI	A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.^[91]
Kwampirs	Kwampirs collects a list of files and directories in C:\ with the command `dir /s /a c:\ >> "C:\windows\TEMP[RANDOM].tmp"`.^[92]
Lazarus Group	Several Lazarus Group malware samples use a common function to identify target files by their extension. Lazarus Group malware families can also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.^[93]^[94]
Leafminer	Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.^[95]
Linfo	Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.^[96]
Machete	Machete produces file listings in order to search for files to be exfiltrated.^[97]
Magic Hound	Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.^[98]
MESSAGETAP	MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.^[99]
Metamorfo	Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.^[100]^[101]^[102]
Micropsia	Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.^[103]
MiniDuke	MiniDuke can enumerate local drives.^[60]
Misdat	Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.^[50]
MobileOrder	MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.^[104]
MoonWind	MoonWind has a command to return a directory listing for a specified directory.^[105]
MuddyWater	MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."^[106]
NDiskMonitor	NDiskMonitor can obtain a list of all files and directories as well as logical drives.^[23]
NETEAGLE	NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.^[22]
njRAT	njRAT can browse file systems using a file manager module.^[107]
OceanSalt	OceanSalt can extract drive information from the endpoint and search files on the system.^[108]
Octopus	Octopus collects information on the Windows directory and searches for compressed RAR files on the host.^[109]
Okrum	Okrum has used DriveLetterView to enumerate drive information.^[110]
Orz	Orz can gather victim drive information.^[111]
OwaAuth	OwaAuth has a command to list its directory and logical drives.^[72]
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of files.^[112]
Patchwork	A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.^[113]^[23]
PinchDuke	PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.^[66]
Pisloader	Pisloader has commands to list drives on the victim machine and to list file information for a given directory.^[114]
PLEAD	PLEAD has the ability to list drives and files on the compromised host.^[90]^[115]
PlugX	PlugX has a module to enumerate drives and find files recursively.^[116]
PoetRAT	PoetRAT has the ability to list files upon receiving the `ls` command from C2.^[117]
POORAIM	POORAIM can conduct file browsing.^[38]
PoshC2	PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.^[118]
PowerDuke	PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.^[119]
POWRUNER	POWRUNER may enumerate user directories on a victim.^[120]
Prikormka	A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.^[121]
Proxysvc	Proxysvc lists files in directories.^[94]
Psylo	Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.^[104]
Pteranodon	Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.^[122]
Pupy	Pupy can walk through directories and recursively search for strings in files.^[123]
Ramsay	Ramsay can scan for Microsoft Word documents within the target's filesystem.^[124]
RARSTONE	RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.^[125]
RedLeaves	RedLeaves can enumerate and search for files and directories.^[126]^[34]
Remcos	Remcos can search for files on the infected machine.^[127]
Remexi	Remexi searches for files on the system. ^[128]
Remsec	Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.^[129]^[130]^[131]
REvil	REvil has the ability to identify specific files and directories that are not to be encrypted.^[132]^[133]^[134]^[135]^[136]^[137]
Rising Sun	Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.^[138]
ROKRAT	ROKRAT has the ability to gather a list of files and directories on the infected system.^[139]^[140]
Rover	Rover automatically searches for files on local drives based on a predefined list of file extensions.^[141]
RTM	RTM can check for specific files and directories associated with virtualization and malware analysis.^[142]
Ryuk	Ryuk has called `GetLogicalDrives` to emumerate all mounted drives, and `GetDriveTypeW` to determine the drive type.^[143]
SDBot	SDBot has the ability to get directory listings or drive information on a compromised host.^[144]
Seasalt	Seasalt has the capability to identify the drive type on a victim.^[108]
ShimRat	ShimRat can list directories.^[145]
SHOTPUT	SHOTPUT has a command to obtain a directory listing.^[146]
Skidmap	Skidmap has checked for the existence of specific files including `/usr/sbin/setenforce` and `/etc/selinux/config`. It also has the ability to monitor the cryptocurrency miner file and process. ^[147]
Smoke Loader	Smoke Loader recursively searches through directories for files.^[148]
SoreFang	SoreFang has the ability to list directories.^[149]
SOUNDBITE	SOUNDBITE is capable of enumerating and manipulating files and directories.^[150]
Sowbug	Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.^[151]
SPACESHIP	SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.^[22]
StreamEx	StreamEx has the ability to enumerate drive types.^[152]
StrongPity	StrongPity can parse the hard drive on a compromised host to identify specific file extensions.^[153]
Sunburst	Sunburst had commands to enumerate files and directories.^[154]^[155]
Sunspot	Sunspot enumerated the Orion software Visual Studio solution directory path.^[156]
SynAck	SynAck checks its directory location in an attempt to avoid launching in a sandbox.^[157]^[158]
TajMahal	TajMahal has the ability to index files from drives, user profiles, and removable drives.^[159]
TINYTYPHON	TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.^[16]
TrickBot	TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.^[160]^[161]
Trojan.Karagany	Trojan.Karagany can enumerate files and directories on a compromised host.^[162]
Tropic Trooper	Tropic Trooper has monitored files' modified time.^[163]
TSCookie	TSCookie has the ability to discover drive information on the infected host.^[164]
Turla	Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.^[57]^[165] Turla RPC backdoors have also searched for files matching the `lPH*.dll` pattern.^[166]
TYPEFRAME	TYPEFRAME can search directories for files on the victim’s machine.^[167]
UNC2452	UNC2452 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.^[168]
UPPERCUT	UPPERCUT has the capability to gather the victim's current directory.^[169]
USBferry	USBferry can detect the victim's file or folder list.^[163]
USBStealer	USBStealer searches victim drives for files matching certain extensions (".skr",".pkr" or ".key") or names.^[170]^[171]
Volgmer	Volgmer can list directories on a victim.^[172]
WannaCry	WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.^[173]^[174]
WindTail	WindTail has the ability to enumerate the users home directory and the path to its own application bundle.^[175]^[176]
WINERACK	WINERACK can enumerate files and directories.^[38]
WinMM	WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.^[177]
XAgentOSX	XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.^[178] XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running `ls -la ~/Library/Application\ Support/MobileSync/Backup/`.^[178]
yty	yty gathers information on victim’s drives and has a plugin for document listing.^[179]
Zebrocy	Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the `echo %APPDATA%` command to list the contents of the directory.^[180]^[181]^[182] Zebrocy can obtain the current execution path as well as perform drive enumeration.^[183]
Zeus Panda	Zeus Panda searches for specific directories on the victim’s machine.^[184]
ZLib	ZLib has the ability to enumerate files and drives.^[50]
zwShell	zwShell can browse the file system.^[185]
ZxShell	ZxShell has a command to open a file manager and explorer on the system.^[186]

Mitigations

This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.

Detection

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained.

Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell.

File and Directory Discovery

Procedure Examples

Mitigations

Detection

References