Detect Hidden Files and Directories in IBM QRadar
Adversaries may set files and directories to be hidden to evade detection mechanisms. On Windows, the attrib command can set the hidden (+h) and system (+s) attributes on files and directories. On Linux/macOS, files and directories prefixed with a period (.) are hidden by convention. Adversaries use these techniques to hide malware, persistence mechanisms, and staging directories from casual file system inspection. Malware families including QakBot, APT28, RedCurl, and XCSSET use hidden file/directory techniques for persistence and evasion.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.001 Hidden Files and Directories
- Canonical reference
- https://attack.mitre.org/techniques/T1564/001/
QRadar Detection Query
SELECT
DATEFORMAT(starttime, 'YYYY-MM-dd HH:mm:ss') AS event_time,
sourceip,
username,
"Process Name",
"Command",
"Parent Process Name",
CASE
WHEN "Command" ILIKE '%+h%' THEN 1 ELSE 0
END AS hidden_attr,
CASE
WHEN "Command" ILIKE '%+s%' THEN 1 ELSE 0
END AS system_attr,
CASE
WHEN "Command" ILIKE '%Temp%'
OR "Command" ILIKE '%AppData%'
OR "Command" ILIKE '%ProgramData%'
OR "Command" ILIKE '%Recycle%'
OR "Command" ILIKE '%Windows%' THEN 1 ELSE 0
END AS suspicious_target,
CASE
WHEN "Parent Process Name" ILIKE '%cmd.exe%'
OR "Parent Process Name" ILIKE '%powershell.exe%'
OR "Parent Process Name" ILIKE '%wscript.exe%'
OR "Parent Process Name" ILIKE '%cscript.exe%' THEN 1 ELSE 0
END AS suspicious_parent
FROM events
WHERE
LOGSOURCETYPENAME(devicetype) IN ('Microsoft Windows Security Event Log', 'Sysmon')
AND (
QIDNAME(qid) = 'Process Create'
OR QIDNAME(qid) LIKE '%EventID 4688%'
OR QIDNAME(qid) LIKE '%EventID 1%'
)
AND "Process Name" ILIKE '%attrib.exe%'
AND (
"Command" ILIKE '%+h%'
OR "Command" ILIKE '%+s%'
OR "Command" ILIKE '%+r%'
)
AND starttime > NOW() - 86400000
HAVING (hidden_attr + system_attr + suspicious_target + suspicious_parent) > 1
ORDER BY starttime DESCQRadar AQL detection for attrib.exe invocations that set hidden, system, or read-only file attributes, scored by risk factors including suspicious target paths and parent process lineage. Risk score threshold filters noise from benign administrative use.
Data Sources
Required Tables
False Positives & Tuning
- Enterprise software deployment tools (SCCM, Intune) using attrib.exe to hide deployment artifacts during staging
- Anti-virus or endpoint security products marking their own directories as hidden and system-protected
- Legitimate scheduled tasks or IT scripts that set attributes on backup or log directories to prevent accidental modification
Other platforms for T1564.001
Testing Methodology
Validate this detection against 3 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hide File Using attrib.exe
Expected signal: Sysmon Event ID 1: attrib.exe with +h +s and Temp path. Security Event ID 4688. Sysmon Event ID 2 (File Time Changed) or file attribute modification event for the hidden file.
- Test 2Hide Directory Using attrib.exe from PowerShell
Expected signal: Sysmon Event ID 1: powershell.exe then attrib.exe with +h +s AppData path. SuspiciousParent and SuspiciousTarget both fire. Directory creation event (Sysmon EventCode=11) for the staging directory.
- Test 3Create Hidden File on Linux with Dot Prefix
Expected signal: Linux audit log: file creation event for /tmp/.hidden_payload.sh. Syslog: if auditd is configured with file watch on /tmp, the create and chmod events will appear. The file does not appear in 'ls /tmp' without -a flag.
References (4)
- https://attack.mitre.org/techniques/T1564/001/
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md
- https://docs.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
- https://www.elastic.co/blog/ten-process-injection-techniques-technical-survey-common-and-trending-process
Unlock Pro Content
Get the full detection package for T1564.001 including response playbook, investigation guide, and atomic red team tests.