T1564.001sub-technique of T1564 Hide Artifacts

Hidden Files and Directories

Linux · macOS · Windowsnothing on this site yetT1564.001 on attack.mitre.org

Adversaries may set files and directories to be hidden to evade detection mechanisms. To prevent normal users from accidentally changing special files on a system, most operating systems have the concept of a ‘hidden’ file. These files don’t show up when a user browses the file system with a GUI or when using normal commands on the command line.
MITRE ATT&CK 19.2, retrieved 2026-09-12

how MITRE says to see it

Detection Strategy for Hidden Files and Directories

Suspicious use of attrib.exe or PowerShell commands to set hidden attributes on files/directories. Defender view: processes modifying file attributes to 'hidden' or creating files with ADS (alternate data streams).
Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.
Use of chflags hidden or SetFile -a V commands to hide files, or creation of hidden files with leading '.'. Defender view: monitoring process execution and file metadata changes setting UF_HIDDEN attribute.

the rest of T1564

T1564.002 Hidden Users · not covered yet
T1564.003 Hidden Window · not covered yet
T1564.004 NTFS File Attributes · not covered yet
T1564.005 Hidden File System · not covered yet
T1564.006 Run Virtual Instance · not covered yet
T1564.007 VBA Stomping · not covered yet
T1564.008 Email Hiding Rules · 2 on this site
T1564.009 Resource Forking · not covered yet
T1564.010 Process Argument Spoofing · not covered yet
T1564.011 Ignore Process Interrupts · not covered yet
T1564.012 File/Path Exclusions · not covered yet
T1564.013 Bind Mounts · not covered yet
T1564.014 Extended Attributes · not covered yet

The description, detection analytics and mitigations are reproduced from MITRE ATT&CK, version 19.2, under its terms of use. The checklists, hunts, labs and everything else linked here are this site’s.