Detect File and Directory Discovery in Microsoft Sentinel
Adversaries may enumerate files and directories or search specific filesystem locations to gather information about a host or network share. This discovery technique helps adversaries identify sensitive files, understand the environment, and shape follow-on behavior such as targeted exfiltration or lateral movement. Common tools include dir, tree, ls, find, locate, and forfiles. Adversaries may also search for credential files, configuration files, or documents with specific extensions using recursive enumeration patterns.
MITRE ATT&CK
- Tactic
- Discovery
- Technique
- T1083 File and Directory Discovery
- Canonical reference
- https://attack.mitre.org/techniques/T1083/
KQL Detection Query
let RecursiveFlags = dynamic(["/s", "/S", "-Recurse", "-recurse", "-r ", "--recursive", "-R "]);
let CredentialExtensions = dynamic([".key", ".pem", ".pfx", ".p12", ".cer", ".kdbx", "id_rsa", "authorized_keys", ".ppk", "password", "passwd", "credential", "secret", ".aws", "web.config", "appsettings"]);
let SuspiciousParents = dynamic(["winword.exe", "excel.exe", "powerpnt.exe", "outlook.exe", "mshta.exe", "wscript.exe", "cscript.exe", "regsvr32.exe", "rundll32.exe", "msiexec.exe", "msedge.exe", "chrome.exe", "firefox.exe"]);
let SensitivePaths = dynamic(["\\Users\\", "\\AppData\\", "\\Documents\\", "\\Desktop\\", "\\temp\\", "\\tmp\\", "\\ssh\\", "\\.aws\\", "\\.config\\", "\\inetpub\\", "\\wwwroot\\"]);
DeviceProcessEvents
| where Timestamp > ago(24h)
| where (
// Windows CMD file discovery
(FileName =~ "cmd.exe" and ProcessCommandLine has_any ("dir ", "tree ", "forfiles") and ProcessCommandLine has_any (RecursiveFlags))
// PowerShell file discovery
or (FileName in~ ("powershell.exe", "pwsh.exe") and ProcessCommandLine has_any ("Get-ChildItem", "gci ", "Get-Item") and ProcessCommandLine has_any (RecursiveFlags))
// find.exe or where.exe with broad scope
or (FileName in~ ("find.exe", "where.exe") and ProcessCommandLine matches regex @"[A-Za-z]:\\\\")
)
| extend IsRecursive = ProcessCommandLine has_any (RecursiveFlags)
| extend IsSuspiciousParent = InitiatingProcessFileName has_any (SuspiciousParents)
| extend TargetsSensitivePath = ProcessCommandLine has_any (SensitivePaths)
| extend HuntsCredentials = ProcessCommandLine has_any (CredentialExtensions)
| extend SuspicionScore = toint(IsRecursive) + toint(IsSuspiciousParent) * 2 + toint(TargetsSensitivePath) + toint(HuntsCredentials) * 2
| where SuspicionScore >= 2
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine,
IsRecursive, IsSuspiciousParent, TargetsSensitivePath, HuntsCredentials, SuspicionScore
| sort by SuspicionScore desc, Timestamp descDetects suspicious file and directory discovery activity using Microsoft Defender for Endpoint DeviceProcessEvents. Monitors cmd.exe, PowerShell, and native find utilities executing recursive enumeration commands. Assigns a suspicion score based on recursive flags, suspicious parent processes (Office apps, browsers, script hosts), sensitive path targeting, and credential-related file searches. Alerts fire at score >= 2 to reduce noise while catching meaningful enumeration patterns.
Data Sources
Required Tables
False Positives & Tuning
- Backup and archival software (Veeam, Backup Exec, Robocopy scripts) performing scheduled recursive scans
- IT asset inventory tools (SCCM hardware inventory, Lansweeper, PDQ Inventory) enumerating file systems
- Security scanners (Nessus, Qualys, Tenable) and EDR agents performing file integrity monitoring sweeps
- Developer IDE indexers (Visual Studio Code, JetBrains) scanning project directories on first open
- File synchronization clients (OneDrive, Dropbox, SharePoint sync) performing reconciliation passes
Other platforms for T1083
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Recursive Directory Listing via CMD
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'dir /s /b C:\Users'. Security Event ID 4688 (if command line auditing enabled). Sysmon Event ID 11: File Create for %TEMP%\df00tech-dir-test.txt. Parent process will be the shell or test runner invoking the command.
- Test 2Credential File Search via PowerShell
Expected signal: Sysmon Event ID 1: Process Create with Image=powershell.exe, CommandLine containing 'Get-ChildItem', '-Recurse', '-Force', and credential extensions (.key, .pem, .pfx, id_rsa, .kdbx). Sysmon Event ID 11: File Create for the output file. PowerShell ScriptBlock Log Event ID 4104 with full script.
- Test 3File Search via Windows where.exe for Executable Targets
Expected signal: Sysmon Event ID 1: Process Create with Image=where.exe, CommandLine containing '/r C:\Program Files *.exe'. Security Event ID 4688 with same details if command line auditing is enabled. Sysmon Event ID 11 for the output file creation.
- Test 4Tree Command for Full Filesystem Enumeration
Expected signal: Sysmon Event ID 1: Process Create with Image=cmd.exe, CommandLine containing 'tree /f /a C:\Users'. Security Event ID 4688 if command line auditing is enabled. Sysmon Event ID 11 for the output file creation in TEMP.
- Test 5Linux Credential File Discovery via find
Expected signal: Linux auditd EXECVE records showing find command with -name patterns for credential files. Syslog entries if process accounting is enabled. On systems with Sysmon for Linux: Event ID 1 (Process Create) with CommandLine showing find with credential extension patterns.
References (7)
- https://attack.mitre.org/techniques/T1083/
- https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html
- https://www.us-cert.gov/ncas/alerts/TA18-106A
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1083/T1083.md
- https://learn.microsoft.com/en-us/defender-endpoint/advanced-hunting-deviceprocessevents-table
- https://docs.splunk.com/Documentation/SplunkCloud/latest/SearchReference/CommonStatsFunctions
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
Unlock Pro Content
Get the full detection package for T1083 including response playbook, investigation guide, and atomic red team tests.