Security ArtifactsDFIR Intelligence
SearchSign inSubscribe

T1083

File and Directory Discovery

ESXi · Linux · macOS · Network Devices · Windows4 pieces on this siteT1083 on attack.mitre.org

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information.

MITRE ATT&CK 19.2, retrieved 2026-09-12

The evidence it leaves

4

Where the traces live, and what each source proves and does not.

how MITRE says to see it

Recursive Enumeration of Files and Directories Across Privilege Contexts

  • Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.
  • Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.
  • Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.
  • Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.