🌐 Introduction
In the intricate dance between cyber adversaries and defenders, one of the most cunning maneuvers is concealing the very traces of intrusion. Imagine a burglar who not only avoids being seen but also erases every footprint, fingerprint, and hint they were ever there. In cybersecurity, this tactic has a name: MITRE ATT&CK Technique T1564 — Hide Artifacts.
This tactic is not a single maneuver, but a collection of subtle concealment approaches. It spans multiple operating systems, manipulates legitimate system features, and capitalizes on the fact that the best way to evade suspicion is to blend in—or vanish entirely.
Today, we’ll walk through each sub-technique in rich detail, examine realistic scenarios, and highlight defensive countermeasures.
🧩 Understanding the Core Concept
Hide Artifacts encompasses any activity where the threat actor deliberately masks elements of their presence to reduce the chance of discovery. This may involve altering file visibility, masking accounts, redirecting observation tools, or abusing system capabilities to operate in plain sight while being functionally invisible.
It’s important to stress that these aren’t crude cover-ups. The hallmark of T1564 is its reliance on features designed for legitimate use. Attackers simply redefine the intent of these features.
📂 T1564.001 – Hidden Files and Directories
🔍 Primary Objective: Disguise malicious storage objects from routine inspection.
Attackers exploit OS-level methods for suppressing file visibility.
- Windows:
attrib +hhides a file from Explorer. - Linux/macOS: Prefixing with
.(dot) prevents normal listing withoutls -a.
Example in Action: A backdoor payload is stored in a hidden subdirectory inside %APPDATA% with system and hidden attributes set. Most file browsers and some backup scripts will overlook it.
Defensive Playbook:
- Regular integrity checks using tools that enumerate hidden entries.
- Baseline directory snapshots to spot unexpected additions.
👤 T1564.002 – Hidden Users
👥 Primary Objective: Keep unauthorized accounts out of administrator view.
Windows Registry: EditingHKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\UserList
with a value of 0 hides the account from the login screen.
macOS: Using dscl with IsHidden property hides accounts from System Preferences.
Operational Example: A stealth administrative account created after initial compromise is hidden from all visible user lists, but still functional for RDP logins.
Counter-Moves:
- Enumerate user accounts via direct OS queries instead of GUI views.
- Review event logs for account creation and group membership changes.
🪟 T1564.003 – Hidden Window
🖥 Primary Objective: Prevent visual cues of a malicious process.
Attackers can spawn applications without visible UI elements, using APIs or scripting flags.
- Windows: Use of
SW_HIDEin WinAPI. - Malware Behavior: TrickBot and other families have spawned hidden browsers for credential harvesting.
Defender’s Strategy:
- Inspect process trees in memory, not just active windows.
- Employ endpoint tools that monitor for headless executions.
📝 T1564.004 – NTFS File Attributes
📜 Primary Objective: Conceal data inside alternate data streams (ADS).
NTFS ADS allows data to be stored within a file without changing its apparent size.
For example:type malware.exe > benign.txt:evil
The malicious content won’t appear in a standard file listing.
Defensive Insight:
- Leverage
dir /Ror forensic tools to enumerate ADS. - Watch for files with unexpectedly large ADS segments.
💽 T1564.005 – Hidden File System
📦 Primary Objective: Store harmful payloads in unlisted storage areas.
Attackers can create virtual file systems or embed content within unused partitions.
Example: Rootkits that mount hidden volumes at runtime, accessible only to specific processes.
Detection Methods:
- Disk imaging and raw sector analysis.
- Compare OS-reported disk usage with actual physical capacity.
📧 T1564.008 – Email Hiding Rules
📩 Primary Objective: Prevent security alerts or incident communications from reaching defenders.
Threat actors set server-side mailbox rules to automatically delete, forward, or move certain emails. This could suppress notifications from security platforms.
Mitigation:
- Monitor for mailbox rule creation or modification events.
- Restrict permissions for self-service rule creation in high-value accounts.
🛑 T1564.011 – Ignore Process Interrupts
⏳ Primary Objective: Ensure processes persist despite system events.
Linux/macOS: nohup runs a process immune to hangups.
Windows: Certain PowerShell error suppression flags (-ErrorAction SilentlyContinue) keep malicious scripts from failing visibly.
Defensive Response:
- Track process start events with unusual flags.
- Use kernel-level auditing for persistent background tasks.
📂 T1564.012 – File/Path Exclusions
🚫 Primary Objective: Hide in “trusted” zones exempted from scanning.
If an attacker uploads tools into a folder excluded from antivirus scanning—either through policy manipulation or exploiting existing exclusions—the payload may never be scanned.
Preventative Measure:
- Regularly audit AV exclusion lists.
- Avoid blanket exclusions, particularly for writable directories.
🔗 T1564.013 – Bind Mounts
🔄 Primary Objective: Overlay malicious content with benign appearances.
On Linux, mount --bind can replace a directory’s view, making monitoring tools show sanitized data instead of the real files.
Detection:
- Monitor
mountandumountsystem calls. - Track sudden changes to
/procviews.
🎨 T1564.009 – Resource Forking
🎭 Primary Objective: Exploit macOS resource forks to embed hidden material.
Resource forks, designed for metadata and alternate content, can store payloads undetected by traditional scanners.
Counteraction:
- Tools like
xattrandls -l@can enumerate extra file streams. - Forensic sweeps should parse fork data specifically.
🛠 T1564.006 – Run Virtual Instance
💡 Primary Objective: Operate within an isolated virtual environment invisible to the host OS.
An attacker may spin up a virtual machine or container inside a compromised endpoint to run tools without direct footprint on the main system.
Defensive Tactic:
- Detect hypervisor driver loads or nested virtualization.
- Correlate CPU usage spikes with absent process listings.
📚 T1564.007 – VBA Stomping
📑 Primary Objective: Disguise malicious macros by removing plain-text source code from Office documents, leaving only compiled p-code.
Mitigation:
- Use tools that extract and decompile macro p-code.
- Block macros from untrusted sources entirely.
🖋 T1564.010 – Process Argument Spoofing
✏ Primary Objective: Launch commands with misleading argument strings to fool defenders inspecting process lists.
Example: A reverse shell may display as a harmless ping command in ps output by replacing argument values.
Defense:
- Capture raw syscall arguments.
- Use kernel event auditing to verify actual execution parameters.
📜 T1564.014 – Extended Attributes
🧾 Primary Objective: Hide data in file attributes rather than file content.
Extended attributes can hold large payloads invisible to basic content checks.
Mitigation:
- Enumerate all attributes with forensic tools.
- Apply strict write permissions to files where attributes are critical.
🧠 Why This Matters
T1564 is more than just a grab bag of hiding tricks. It represents a psychological game where attackers bet on defenders missing small anomalies in a sea of normal activity. The techniques are portable across industries, adaptable to multiple platforms, and—most critically—often work without breaking a single security policy on paper.
🛡 Defender’s Holistic Approach
1️⃣ Layered Monitoring
Combine file system auditing, process tracing, registry/watchpoint monitoring, and email rule inspections into a cohesive visibility framework.
2️⃣ Behavior-Based Detection
Signature matching alone won’t uncover a hidden user or mount overlay. Behavioral baselining and anomaly detection can reveal the subtle “off” moments.
3️⃣ Threat Hunting as Routine
Integrate hunts for hidden artifacts into weekly or monthly operational cycles—don’t wait for an alert.
4️⃣ User Awareness
Educate technical staff on where to check beyond the GUI—many of these methods rely on the defender only using surface-level tools.
🏁 Conclusion
Hide Artifacts (T1564) is the cybersecurity equivalent of a magician’s sleight of hand. Adversaries don’t always need to dodge every spotlight; they just need to be standing where no one is looking. Defenders who develop the reflex to look in the unlit corners—hidden directories, ADS, excluded folders, unlisted accounts—will stand a far better chance of unmasking these ghostly intrusions.
ITInnovationStation 
Leave a comment