Detect Hide Artifacts in Microsoft Sentinel
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection. Sub-techniques cover hidden files and directories, hidden users, hidden windows, NTFS alternate data streams, hidden file systems, virtual instance abuse, VBA stomping, email hiding rules, resource forking, process argument spoofing, and scheduled task SD registry deletion.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Canonical reference
- https://attack.mitre.org/techniques/T1564/
KQL Detection Query
// T1564 — Hide Artifacts: multi-signal detection across sub-techniques
// Signal 1: attrib command used to hide files or directories (T1564.001)
let HiddenFileAttrib = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName =~ "attrib.exe"
| where ProcessCommandLine has_any ("+h ", "+s ", "+h+s", "+s+h")
| extend Signal = "HiddenFileAttribute"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 2: NTFS Alternate Data Streams written via cmd/powershell (T1564.004)
let ADSCreation = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe")
| where ProcessCommandLine matches regex @">\s*[^\s:]+:[^\\/:*?""<>|\s]+"
or ProcessCommandLine has "Set-Content" and ProcessCommandLine matches regex @"-Path\s+[^:]+:[^\s]+"
or ProcessCommandLine has "Out-File" and ProcessCommandLine matches regex @"-FilePath\s+[^:]+:[^\s]+"
| extend Signal = "NTFSAlternateDataStream"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 3: Scheduled task Security Descriptor (SD) registry value deletion (Tarrask — T1564)
let HiddenScheduledTask = DeviceRegistryEvents
| where Timestamp > ago(24h)
| where ActionType == "RegistryValueDeleted"
| where RegistryKey has @"\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree"
| where RegistryValueName =~ "SD"
| extend Signal = "HiddenScheduledTaskSD"
| project Timestamp, DeviceName, AccountName=InitiatingProcessAccountName,
FileName=InitiatingProcessFileName, ProcessCommandLine=InitiatingProcessCommandLine,
RegistryKey, RegistryValueName,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 4: Hidden window flag used in scripting (T1564.003)
let HiddenWindow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where ProcessCommandLine has_any ("-WindowStyle Hidden", "-w hidden", "-WindowStyle h",
"/windowstyle hidden", "SW_HIDE", "ShowWindow", "0x0 start")
| where FileName !in~ ("explorer.exe", "msiexec.exe", "svchost.exe")
| extend Signal = "HiddenWindowExecution"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 5: Windows API calls to hide window via wscript/cscript/mshta
let HiddenScriptWindow = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("wscript.exe", "cscript.exe", "mshta.exe")
| where ProcessCommandLine has_any ("//b ", "//B ", "CreateObject", "WScript.CreateObject")
| extend Signal = "HiddenScriptBatchMode"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Signal 6: icacls or cacls used to deny Everyone/Users access to hide files (T1564.001)
let AccessDenialToHide = DeviceProcessEvents
| where Timestamp > ago(24h)
| where FileName in~ ("icacls.exe", "cacls.exe", "takeown.exe")
| where ProcessCommandLine has_any ("/deny Everyone", "/deny *S-1-1-0", "/deny Users", "/deny *S-1-5-32-545")
| extend Signal = "FileAccessDeniedToHide"
| project Timestamp, DeviceName, AccountName, FileName, ProcessCommandLine,
InitiatingProcessFileName, InitiatingProcessCommandLine, Signal;
// Union all signals
union HiddenFileAttrib, ADSCreation, HiddenScheduledTask, HiddenWindow, HiddenScriptWindow, AccessDenialToHide
| sort by Timestamp descMulti-signal detection for T1564 Hide Artifacts across the most commonly observed sub-techniques. Detects: (1) attrib.exe setting hidden/system file attributes; (2) NTFS Alternate Data Stream creation via cmd or PowerShell redirection syntax; (3) Scheduled task Security Descriptor registry value deletion — the Tarrask technique that makes tasks invisible to schtasks and Task Scheduler UI; (4) hidden window execution flags in process command lines; (5) wscript/cscript batch mode (//b) used to suppress windows; (6) icacls used to deny access to files, obscuring them from normal users. Uses DeviceProcessEvents and DeviceRegistryEvents from Microsoft Defender for Endpoint.
Data Sources
Required Tables
False Positives & Tuning
- System administrators using attrib.exe to mark backup or configuration files as hidden/system to prevent accidental deletion
- Software installers and package managers that legitimately set hidden attributes on their program files during installation
- Legitimate security or monitoring tools that use hidden windows (wscript //b, mshta) for background polling and scheduled checks
- Enterprise backup solutions (Veeam, Commvault) that manipulate NTFS attributes and ACLs as part of their backup and restore operations
- Development tools (Visual Studio, Node.js) that create NTFS Alternate Data Streams as part of zone identifier or metadata tracking
Other platforms for T1564
Testing Methodology
Validate this detection against 5 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Hide File Using Attrib Command
Expected signal: Sysmon Event ID 1: Process Create for attrib.exe with CommandLine '+h +s %TEMP%\t1564-test.txt'. Security Event ID 4688 (if command line auditing enabled). DeviceProcessEvents in MDE: FileName=attrib.exe, ProcessCommandLine contains '+h' and '+s'. The 'dir' command at the end will show no file — confirming hiding worked.
- Test 2Write Payload to NTFS Alternate Data Stream
Expected signal: Sysmon Event ID 15 (FileCreateStreamHash): TargetFilename='%TEMP%\t1564-ads-test.txt:hidden_payload.ps1', Hash of stream content. Sysmon Event ID 1: cmd.exe process create with redirect operator and colon-delimited stream path in CommandLine. DeviceFileEvents in MDE: ActionType=FileCreated with stream notation in FileName. The 'dir /r' output will show both the main file and ':hidden_payload.ps1:$DATA' confirming ADS creation.
- Test 3Delete Scheduled Task Security Descriptor to Hide Task (Tarrask Technique)
Expected signal: Sysmon Event ID 13 (RegistryEvent - Value Delete): TargetObject='HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Schedule\TaskCache\Tree\Microsoft\Windows\T1564-HiddenTask\SD', EventType='DeleteValue', Image='reg.exe'. Security Event ID 4698 (scheduled task created) for the initial schtasks /create. Security Event ID 4699 will NOT fire for the SD deletion — only the Sysmon registry event captures this. DeviceRegistryEvents in MDE: ActionType=RegistryValueDeleted, RegistryKey contains 'TaskCache\Tree', RegistryValueName='SD'.
- Test 4Hide Script Execution Using Wscript Batch Mode (Hidden Window)
Expected signal: Sysmon Event ID 1: Process Create for wscript.exe with CommandLine '//b //nologo %TEMP%\t1564-hidden.vbs'. ParentImage will be cmd.exe (from the atomic test) but in real attacks is often outlook.exe, explorer.exe, or mshta.exe. Security Event ID 4688 (if command line auditing enabled). DeviceProcessEvents in MDE: FileName=wscript.exe, ProcessCommandLine contains '//b'. No console window or UI appears on the desktop.
- Test 5Linux Hidden File and Directory Creation
Expected signal: Auditd syscall events: execve for mkdir, echo/tee, chmod with dotfile paths. Syslog/auditd: SYSCALL records with comm='mkdir' and a0 pointing to path starting with dot. Linux process creation events in Sysmon for Linux (if deployed): Image=/bin/mkdir, CommandLine contains '.t1564-hidden-dir'. The first ls command returns no output (directory is hidden), the second ls -la shows it — confirming the hiding behavior.
References (13)
- https://attack.mitre.org/techniques/T1564/
- https://www.microsoft.com/security/blog/2022/04/12/tarrask-malware-uses-scheduled-tasks-for-defense-evasion/
- https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/
- https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/
- https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/
- https://cdn2.hubspot.net/hubfs/3354902/Content%20PDFs/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf
- https://learn.microsoft.com/en-us/sysinternals/downloads/streams
- https://learn.microsoft.com/en-us/windows-server/administration/windows-commands/attrib
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.001/T1564.001.md
- https://github.com/SigmaHQ/sigma/tree/master/rules/windows/process_creation
- https://www.secureworks.com/research/darktortilla-malware-analysis
- https://www.checkpoint.com/downloads/products/warzone-whitepaper.pdf
- https://www.sentinelone.com/labs/shlayer-to-zshlayer-macos-malware-evolution/
Unlock Pro Content
Get the full detection package for T1564 including response playbook, investigation guide, and atomic red team tests.
Related Detections
Sub-techniques (14)
- T1564.001Hidden Files and Directories
- T1564.002Hidden Users
- T1564.003Hidden Window
- T1564.004NTFS File Attributes
- T1564.005Hidden File System
- T1564.006Run Virtual Instance
- T1564.007VBA Stomping
- T1564.008Email Hiding Rules
- T1564.009Resource Forking
- T1564.010Process Argument Spoofing
- T1564.011Ignore Process Interrupts
- T1564.012File/Path Exclusions
- T1564.013Bind Mounts
- T1564.014Extended Attributes