| name | T1083_file-and-directory-discovery |
| description | Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. |
| category | information-gathering |
| version | 18.1 |
| author | cyberstrike-official |
| tags | ["mitre-attack","enterprise","t1083","discovery","esxi","linux","macos","network-devices","windows"] |
| technique_id | T1083 |
| tactic | discovery |
| all_tactics | ["discovery"] |
| platforms | ["ESXi","Linux","macOS","Network Devices","Windows"] |
| mitre_url | https://attack.mitre.org/techniques/T1083 |
| tech_stack | ["esxi","linux","macos","network devices","windows"] |
| cwe_ids | ["CWE-200"] |
| chains_with | [] |
| prerequisites | [] |
| severity_boost | {} |
T1083 File and Directory Discovery
High-Level Description
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).
Some files and directories may require elevated or specific user permissions to access.
Kill Chain Phase
Platforms: ESXi, Linux, macOS, Network Devices, Windows
What to Check
How to Test
Atomic Red Team Tests
The following tests are from Atomic Red Team and provide actionable ways to test this technique:
Atomic Test 1: File and Directory Discovery (cmd.exe)
Find or discover files on the file system. Upon successful execution, this test will output the results of all the data discovery commands to a specified file.
Supported Platforms: windows
dir /s c:\ >> #{output_file}
dir /s "c:\Documents and Settings" >> #{output_file}
dir /s "c:\Program Files\" >> #{output_file}
dir "%systemdrive%\Users\*.*" >> #{output_file}
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> #{output_file}
dir "%userprofile%\Desktop\*.*" >> #{output_file}
tree /F >> #{output_file}
