T1083

File and Directory Discovery

Discovery Last updated:

Adversaries may enumerate files and directories or search specific filesystem locations to gather information about a host or network share. This discovery technique helps adversaries identify sensitive files, understand the environment, and shape follow-on behavior such as targeted exfiltration or lateral movement. Common tools include dir, tree, ls, find, locate, and forfiles. Adversaries may also search for credential files, configuration files, or documents with specific extensions using recursive enumeration patterns.

What is T1083 File and Directory Discovery?

File and Directory Discovery (T1083) maps to the Discovery tactic — the adversary is trying to figure out your environment in MITRE ATT&CK.

This page provides production-ready detection logic for File and Directory Discovery, covering the data sources and telemetry it touches: Process: Process Creation, Command: Command Execution, Microsoft Defender for Endpoint. The queries below are rated medium severity at medium confidence, and ship for 7 SIEM platforms — KQL, SPL, Elastic, QRadar, Sumo, YARA-L, LogScale.

MITRE ATT&CK

Tactic
Discovery
Technique
T1083 File and Directory Discovery
Canonical reference
https://attack.mitre.org/techniques/T1083/
Microsoft Sentinel / Defender
kusto 
let RecursiveFlags = dynamic(["/s", "/S", "-Recurse", "-recurse", "-r ", "--recursive", "-R "]);
let CredentialExtensions = dynamic([".key", ".pem", ".pfx", ".p12", ".cer", ".kdbx", "id_rsa", "authorized_keys", ".ppk", "password", "passwd", "credential", "secret", ".aws", "web.config", "appsettings"]);
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe", "msiexec.exe", "msedge.exe", "chrome.exe", "firefox.exe"]);
let SensitivePaths = dynamic(["\\Users\\", "\\AppData\\", "\\Documents\\", "\\Desktop\\", "\\temp\\", "\\tmp\\", "\\ssh\\", "\\.aws\\", "\\.config\\", "\\inetpub\\", "\\wwwroot\\"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
    // Windows CMD file discovery
    (FileName =~ "cmd.exe" and ProcessCommandLine has_any ("dir ", "tree ", "forfiles") and ProcessCommandLine has_any (RecursiveFlags))
    // PowerShell file discovery
    or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-ChildItem", "gci ", "Get-Item") and ProcessCommandLine has_any (RecursiveFlags))
    // find.exe or where.exe with broad scope
    or (FileName in~ ("find.exe", "where.exe") and ProcessCommandLine matches regex @"[A-Za-z]:\\\\")
)
| extend IsRecursive = ProcessCommandLine has_any (RecursiveFlags)
| extend IsSuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend TargetsSensitivePath = ProcessCommandLine has_any (SensitivePaths)
| extend HuntsCredentials = ProcessCommandLine has_any (CredentialExtensions)
| extend SuspicionScore = toint(IsRecursive) + toint(IsSuspiciousParent) * 2 + toint(TargetsSensitivePath) + toint(HuntsCredentials) * 2
| where SuspicionScore >= 2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
         InitiatingProcessFileName, InitiatingProcessCommandLine,
         IsRecursive, IsSuspiciousParent, TargetsSensitivePath, HuntsCredentials, SuspicionScore
| sort by SuspicionScore desc, Timestamp desc

Detects suspicious file and directory discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors cmd.exe, PowerShell, and native find utilities executing recursive enumeration commands. Assigns a suspicion score based on recursive flags, suspicious parent processes (Office apps, browsers, script hosts), sensitive path targeting, and credential-related file searches. Alerts fire at score >= 2 to reduce noise while catching meaningful enumeration patterns.

medium severity medium confidence

Data Sources

Process: Process Creation Command: Command Execution Microsoft Defender for Endpoint

Required Tables

DeviceProcessEvents

False Positives

  • Backup and archival software (Veeam, Backup Exec, Robocopy scripts) performing scheduled recursive scans
  • IT asset inventory tools (SCCM hardware inventory, Lansweeper, PDQ Inventory) enumerating file systems
  • Security scanners (Nessus, Qualys, Tenable) and EDR agents performing file integrity monitoring sweeps
  • Developer IDE indexers (Visual Studio Code, JetBrains) scanning project directories on first open
  • File synchronization clients (OneDrive, Dropbox, SharePoint sync) performing reconciliation passes

Sigma rule & cross-platform mapping

The detection logic for File and Directory Discovery (T1083) above is provided in a vendor-neutral form so you can deploy it on any SIEM. The same logic is shipped here as native KQL (Microsoft Sentinel / Defender), SPL (Splunk), Elastic (Elastic Security (EQL)), QRadar (IBM QRadar (AQL)), Sumo (Sumo Logic CSE), YARA-L (Google Chronicle / SecOps), LogScale (CrowdStrike LogScale (CQL)) queries. In Sigma terms, this detection targets the following logsource: 

logsource:
  category: process_creation
  product: windows

Browse the community-maintained Sigma rules for this technique:

SigmaHQ rules for T1083 Sigma rules on detection.fyi

Platform-specific guides for T1083

Detect in Microsoft Sentinel (KQL) Detect in Splunk (SPL) Detect in Elastic Security (Elastic) Detect in IBM QRadar (QRadar) Detect in Sumo Logic CSE (Sumo) Detect in Google Chronicle (YARA-L) Detect in CrowdStrike LogScale (LogScale)
Last updated: 2026-04-13 Research depth: deep
References (6)

Testing Methodology

Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.

  1. Test 1Recursive Directory Listing via CMD

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'dir /s /b C:\Users'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 11: File Create for %TEMP%\df00tech-dir-test.txt. Parent process will be the shell or test runner invoking the command.

  2. Test 2Credential File Search via PowerShell

    Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', '-Force', and credential extensions (.key, .pem, .pfx, id_rsa, .kdbx). Sysmon Event ID 11: File Create for the output file. PowerShell ScriptBlock Log Event ID 4104 with full script.

  3. Test 3File Search via Windows where.exe for Executable Targets

    Expected signal: Sysmon Event ID 1: Process Create with Image=where.exe, CommandLine containing '/r C:\Program Files *.exe'. Security Event ID 4688 with same details if command line auditing is enabled. Sysmon Event ID 11 for the output file creation.

  4. Test 4Tree Command for Full Filesystem Enumeration

    Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'tree /f /a C:\Users'. Security Event ID 4688 if command line auditing is enabled. Sysmon Event ID 11 for the output file creation in TEMP.

  5. Test 5Linux Credential File Discovery via find

    Expected signal: Linux auditd EXECVE records showing find command with -name patterns for credential files. Syslog entries if process accounting is enabled. On systems with Sysmon for Linux: Event ID 1 (Process Create) with CommandLine showing find with credential extension patterns.

Response Playbook

Triage

  1. Identify the executing process and parent process — was file discovery launched by a suspicious parent (Office application, browser, script host like wscript.exe or mshta.exe)? This is the strongest indicator of post-exploitation activity.
  2. Examine the full command line — is the enumeration targeted (specific paths like \Users\, \AppData\, .ssh\) or broad (recursive from C:\)? Targeted searches for credential files (.key, .pem, .kdbx, id_rsa) dramatically increase severity.
  3. Check the user context — is this a service account, domain admin, or interactive user? Does this user normally run recursive directory scans? Review their recent logon history for anomalies.
  4. Review the timeline — did file discovery occur shortly after initial access indicators (suspicious email attachment opened, new process injection, abnormal network connection)? Discovery techniques are typically mid-kill-chain.
  5. Correlate with other discovery techniques — check whether the same host ran T1033 (System Owner/User Discovery), T1057 (Process Discovery), or T1012 (Query Registry) within the same time window, which suggests systematic post-exploitation enumeration.
  6. Check for follow-on exfiltration — did any file creation, compression (zip, 7z, rar), or network transfer events occur in the minutes after the discovery commands? This indicates the enumeration was preparatory to data theft.

Containment

  1. If discovery originated from a suspicious parent process (Office macro, script host): isolate the endpoint immediately via EDR network isolation while preserving memory for forensic acquisition.
  2. If the account used is a privileged service account: disable the account in Active Directory and revoke Kerberos tickets (klist purge equivalent via domain controller) to prevent lateral movement.
  3. If credential-targeted searches were performed (searching for .key, .pem, id_rsa, .kdbx): treat all credentials on the affected host as compromised — initiate rotation for any SSH keys, API tokens, or certificate private keys stored on the system.
  4. Block any external C2 IPs or domains identified in concurrent network events from the same host at the perimeter firewall and DNS resolver.
  5. If lateral movement indicators exist: quarantine additional affected hosts before proceeding with remediation to prevent adversary pivot to clean systems.

Evidence Collection

  1. Sysmon Event ID 1 (Process Create) — full command line, parent process, user context, and timestamps for all file discovery commands
  2. Security Event ID 4688 (Process Create with command line auditing enabled) — if Sysmon is not deployed, use this as fallback with Audit Process Creation + Audit Process Tracking GPO settings
  3. Sysmon Event ID 11 (File Create) — any files written immediately after discovery may indicate output redirection (e.g., dir /s > output.txt)
  4. Sysmon Event ID 3 (Network Connection) — outbound connections from the discovery process or its parent, indicating possible C2 or exfiltration
  5. PowerShell Script Block Logging (Event ID 4104) — if discovery used PowerShell Get-ChildItem, captures full script content including any file content reads
  6. File system: check for output files in TEMP directories — adversaries frequently redirect dir /s output to files for later exfiltration
  7. MFT (Master File Table) — forensic acquisition of $MFT provides complete file access timestamps to determine what files were actually opened after enumeration
  8. Prefetch files — C:\Windows\Prefetch\CMD.EXE-*.pf, POWERSHELL.EXE-*.pf contain execution timestamps and file references for recently accessed resources

Escalation Criteria

  • ! File discovery launched by an Office application, browser, or script host — this is a near-certain indicator of macro-based or scripted initial access followed by post-exploitation
  • ! Enumeration specifically targeting credential files (.key, .pem, .pfx, id_rsa, .kdbx, password files) — treat as confirmed credential theft attempt
  • ! File discovery followed within minutes by archive creation or outbound data transfer — this is an active exfiltration sequence requiring immediate containment
  • ! Multiple hosts showing the same file discovery pattern within a short window — suggests automated post-exploitation framework (Cobalt Strike, Metasploit, Sliver) with lateral movement
  • ! Discovery run under SYSTEM account or a domain admin service account with no corresponding change management ticket
  • ! Recursive enumeration of network shares (UNC paths like \\server\share) combined with outbound SMB traffic to non-corporate IPs

Investigation Guide

Forensic Artifacts

  • > File System: TEMP directory — check for .txt or .log files created immediately after discovery commands, often used as output redirection targets (dir /s /b > %TEMP%\out.txt)
  • > Prefetch: C:\Windows\Prefetch\CMD.EXE-*.pf, FIND.EXE-*.pf, WHERE.EXE-*.pf — execution timestamps and referenced file paths reveal enumeration scope
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\RecentDocs — recently accessed files and folders at the time of enumeration
  • > Registry: HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths — manually typed paths in Windows Explorer File Open dialogs
  • > Shell Bags: HKCU\SOFTWARE\Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU — folder access history with timestamps
  • > LNK Files: %APPDATA%\Microsoft\Windows\Recent\*.lnk — recently accessed file shortcuts with target path, access time, and host metadata
  • > Event Log: Microsoft-Windows-PowerShell/Operational (Event ID 4104) — full script content for any PowerShell-based file enumeration
  • > USN Journal: $Extend\$UsnJrnl — NTFS change journal provides a record of all file system modifications around the time of discovery

Tuning Guidance

Begin by establishing a baseline of legitimate file enumeration in your environment. Key exclusions to build: (1) Backup agent service accounts (often SYSTEM or a dedicated backup SA) running recursive scans on predictable schedules — exclude by InitiatingProcessFileName + AccountName + time window. (2) IT inventory tools — identify their specific parent processes (ccmexec.exe for SCCM, PDQDeployRunner.exe) and exclude those parent-child combinations. (3) Developer workstations where Get-ChildItem is frequently used in build scripts — consider excluding known build service accounts entirely. Tune the suspicion score threshold upward (to 3+) in environments with heavy IT automation. For environments where Office macro abuse is a primary threat vector, lower the threshold for IsSuspiciousParent detections to 1, treating any file discovery from an Office parent as high-priority regardless of other factors. The credential-hunting pattern (HuntsCredentials) should never be excluded and should be routed to a dedicated high-priority queue regardless of score. On Linux/macOS endpoints, add equivalent monitoring for `find / -name`, `locate`, and `ls -laR` patterns from unexpected parent processes using auditd or osquery.

Hunting Queries

Hunt for high-frequency file discovery activity — five or more enumeration commands from the same account within 30-minute windows. Legitimate admin activity rarely requires repeated recursive directory listings; this pattern suggests automated post-exploitation tooling or a script iterating through directories systematically.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "find.exe")
| where ProcessCommandLine has_any ("Get-ChildItem", "gci ", "dir /s", "tree /f", "forfiles", "find /")
| summarize DiscoveryCount=count(), UniqueCommands=dcount(ProcessCommandLine), Earliest=min(Timestamp), Latest=max(Timestamp)
     by DeviceName, AccountName, InitiatingProcessFileName, bin(Timestamp, 30m)
| where DiscoveryCount >= 5
| sort by DiscoveryCount desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\find.exe")
  (CommandLine="*dir /s*" OR CommandLine="*tree /f*" OR CommandLine="*Get-ChildItem*" OR CommandLine="*forfiles*")
| bin _time span=30m
| stats count as DiscoveryCount, dc(CommandLine) as UniqueCommands, earliest(_time) as Earliest, latest(_time) as Latest by host, User, ParentImage, _time
| where DiscoveryCount >= 5
| sort - DiscoveryCount

Hunt for file discovery commands specifically searching for credential material — SSH private keys, certificate files, password databases, cloud credential files (.aws/credentials), and application configuration files containing secrets. This pattern strongly indicates an adversary performing targeted credential harvesting after initial access.

Hunting — KQL
kql 
DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "where.exe", "find.exe")
| where ProcessCommandLine has_any (".key", ".pem", ".pfx", ".p12", ".ppk", "id_rsa", "id_ecdsa", "authorized_keys", ".kdbx", "KeePass", "password", "passwd", "credentials", ".aws\\credentials", "appsettings.json", "web.config", ".env", ".htpasswd")
| project Timestamp, DeviceName, AccountName, ProcessCommandLine, InitiatingProcessFileName, InitiatingProcessCommandLine
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe" OR Image="*\\where.exe" OR Image="*\\find.exe")
  (CommandLine="*.key" OR CommandLine="*.pem" OR CommandLine="*.pfx" OR CommandLine="*.ppk" OR CommandLine="*id_rsa*" OR CommandLine="*authorized_keys*" OR CommandLine="*.kdbx*" OR CommandLine="*password*" OR CommandLine="*.aws*" OR CommandLine="*appsettings*" OR CommandLine="*.env" OR CommandLine="*web.config*")
| table _time, host, User, Image, CommandLine, ParentImage, ParentCommandLine
| sort - _time

Hunt for file discovery commands followed within 15 minutes by outbound public network connections from the same host and account. This sequence — enumerate files then connect externally — is a strong indicator of data staging and exfiltration. Particularly relevant to threat actors like Volt Typhoon and Contagious Interview who perform targeted file enumeration before exfiltration.

Hunting — KQL
kql 
let DiscoveryWindow = 15m;
let DiscoveryCmds = DeviceProcessEvents
| where Timestamp > ago(7d)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "find.exe", "where.exe")
| where ProcessCommandLine has_any ("dir ", "tree ", "Get-ChildItem", "gci ", "forfiles", "find /", "where /r")
| project DiscoveryTime=Timestamp, DeviceName, AccountName;
DeviceNetworkEvents
| where Timestamp > ago(7d)
| where RemoteIPType == "Public"
| join kind=inner DiscoveryCmds on DeviceName, AccountName
| where Timestamp between ((DiscoveryTime) .. (DiscoveryTime + DiscoveryWindow))
| project Timestamp, DeviceName, AccountName, RemoteIP, RemotePort, RemoteUrl, DiscoveryTime
| sort by Timestamp desc
Hunting — SPL
spl 
index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=1
  (Image="*\\cmd.exe" OR Image="*\\powershell.exe" OR Image="*\\pwsh.exe")
  (CommandLine="*dir *" OR CommandLine="*tree *" OR CommandLine="*Get-ChildItem*")
| eval discovery_time=_time
| rename host as discovery_host, User as discovery_user
| join type=inner discovery_host
    [search index=wineventlog sourcetype="XmlWinEventLog:Microsoft-Windows-Sysmon/Operational" EventCode=3
     NOT (DestinationIp="10.*" OR DestinationIp="172.16.*" OR DestinationIp="192.168.*" OR DestinationIp="127.*")
     | rename host as discovery_host]
| eval time_delta=_time - discovery_time
| where time_delta >= 0 AND time_delta <= 900
| table _time, discovery_host, discovery_user, CommandLine, DestinationIp, DestinationPort
| sort - _time

Atomic Red Team Tests

Test 1 Recursive Directory Listing via CMD
windows

Performs a recursive directory listing of the C:\Users directory using cmd.exe dir /s. This is one of the most common file discovery patterns observed in post-exploitation frameworks (Cobalt Strike, Metasploit) and malware families including PlugX, SDBbot, and Volgmer. The /b flag suppresses headers and footers, producing clean output suitable for automated parsing.

Command

powershell 
cmd.exe /c dir /s /b C:\Users\%USERNAME%\Documents > %TEMP%\df00tech-dir-test.txt 2>&1

Cleanup

powershell 
del %TEMP%\df00tech-dir-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'dir /s /b C:\Users'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 11: File Create for %TEMP%\df00tech-dir-test.txt. Parent process will be the shell or test runner invoking the command.

Expected Detection

Alert fires with IsRecursive=true (score +1) and TargetsSensitivePath=true (score +1), SuspicionScore=2, meeting the >= 2 threshold. KQL: ProcessCommandLine has '/s' and TargetsSensitivePath. SPL: IsRecursive=1 + TargetsSensitivePath=1, SuspicionScore >= 2.

Test 2 Credential File Search via PowerShell
windows

Uses PowerShell Get-ChildItem with -Recurse and -Include to search for common credential file types across the user profile. This mimics the behavior of credential-harvesting malware including Attor (which searched for .skr/.pkr/.key files), USBStealer, and the Contagious Interview threat group which performs keyword searches on compromised hosts prior to exfiltration.

Command

powershell 
powershell.exe -NoProfile -Command "Get-ChildItem -Path $env:USERPROFILE -Recurse -Force -Include '*.key','*.pem','*.pfx','id_rsa','*.kdbx' -ErrorAction SilentlyContinue | Select-Object FullName, LastWriteTime | Out-File $env:TEMP\df00tech-cred-search.txt"

Cleanup

powershell 
Remove-Item $env:TEMP\df00tech-cred-search.txt -ErrorAction SilentlyContinue

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', '-Force', and credential extensions (.key, .pem, .pfx, id_rsa, .kdbx). Sysmon Event ID 11: File Create for the output file. PowerShell ScriptBlock Log Event ID 4104 with full script.

Expected Detection

Alert fires with IsRecursive=true (+1), TargetsSensitivePath=true (+1), HuntsCredentials=true (+2), SuspicionScore=4. KQL: ProcessCommandLine has '-Recurse' and has_any credential extensions. SPL: IsRecursive=1 + TargetsSensitivePath=1 + HuntsCredentials=1, SuspicionScore >= 4.

Test 3 File Search via Windows where.exe for Executable Targets
windows

Uses the Windows where.exe utility to recursively locate executable files across the C: drive. Adversaries use this technique to identify installed security tools, backup agents, and privileged applications before attempting to disable or bypass them. Amadey malware uses this pattern specifically to locate antivirus software folders.

Command

powershell 
where /r C:\Program Files *.exe > %TEMP%\df00tech-where-test.txt 2>&1

Cleanup

powershell 
del %TEMP%\df00tech-where-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=where.exe, CommandLine containing '/r C:\Program Files *.exe'. Security Event ID 4688 with same details if command line auditing is enabled. Sysmon Event ID 11 for the output file creation.

Expected Detection

Alert fires with IsRecursive=true (+1) and the broad path scope. KQL: FileName =~ 'where.exe' and ProcessCommandLine matches regex for drive letter. SPL: match(Image, 'where\.exe') with recursive flag, SuspicionScore >= 2 when combined with path targeting.

Test 4 Tree Command for Full Filesystem Enumeration
windows

Executes the tree command with /f (show files) and /a (ASCII output) flags to produce a complete filesystem listing. The tree utility produces structured output that is easy to parse programmatically. This technique was observed in Volt Typhoon intrusions where adversaries mapped facility infrastructure data directories before targeted exfiltration.

Command

powershell 
cmd.exe /c tree /f /a C:\Users\%USERNAME% > %TEMP%\df00tech-tree-test.txt 2>&1

Cleanup

powershell 
del %TEMP%\df00tech-tree-test.txt 2>nul

Expected Telemetry

Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'tree /f /a C:\Users'. Security Event ID 4688 if command line auditing is enabled. Sysmon Event ID 11 for the output file creation in TEMP.

Expected Detection

Alert fires with IsRecursive=true (+1) and TargetsSensitivePath=true (+1), SuspicionScore=2. KQL: ProcessCommandLine has 'tree ' and TargetsSensitivePath. SPL: match(cmdline, 'tree\s') with path match, SuspicionScore=2.

Test 5 Linux Credential File Discovery via find
linux

Uses the Linux find utility to recursively search for SSH keys, configuration files, and credential material across common locations. This pattern is consistent with post-exploitation enumeration by Kinsing malware and the Contagious Interview threat group operating on Linux targets. The -name patterns cover the most commonly targeted credential files.

Command

bash 
find /home /root /etc -type f \( -name 'id_rsa' -o -name 'id_ecdsa' -o -name '*.pem' -o -name '*.key' -o -name 'authorized_keys' -o -name '.htpasswd' -o -name '*.env' \) 2>/dev/null > /tmp/df00tech-find-test.txt

Cleanup

bash 
rm -f /tmp/df00tech-find-test.txt

Expected Telemetry

Linux auditd EXECVE records showing find command with -name patterns for credential files. Syslog entries if process accounting is enabled. On systems with Sysmon for Linux: Event ID 1 (Process Create) with CommandLine showing find with credential extension patterns.

Expected Detection

On Linux with auditd: EXECVE events showing 'find' with credential-related -name arguments. With Sysmon for Linux: process creation event matching find + credential extension patterns in command line. SIEM alert on credential extension enumeration pattern.

Related Detections

Tactic Hub

TA0007Discovery

Related Techniques

T1005Data from Local SystemT1074.001Local Data StagingT1552.001Credentials In FilesT1033System Owner/User DiscoveryT1057Process DiscoveryT1082System Information DiscoveryT1560.001Archive via UtilityT1041Exfiltration Over C2 ChannelT1059.001PowerShell

Same Tactic: Discovery

Popular Detections