Procedure examples

HAFNIUM has hidden files on a compromised host.

FIN7 has used `attrib +h “C:\ProgramData\ssh”` to make the SSH folder hidden.

Mustang Panda's PlugX variant has created a hidden folder on USB drives named RECYCLE.BIN to store malicious executables and collected data. Mustang Panda has also modified file attributes to `hidden` and `system`.

Rocke downloaded a file "libprocesshider", which could hide files on the target system.

Tropic Trooper has created a hidden directory under C:\ProgramData\Apple\Updates\ and C:\Users\Public\Documents\Flash\.

RedCurl added the “hidden” file attribute to original files, manipulating victims to click on malicious LNK files.

LuminousMoth has used malware to store malicious binaries in hidden directories on victim's USB drives.

APT28 has saved files with hidden file attributes.

Lazarus Group has used a VBA Macro to set its file attributes to System and Hidden and has named files with a dot prefix to hide them from the Finder application.

Transparent Tribe can hide legitimate directories and replace them with malicious copies of the same name.

FIN13 has created hidden files and folders within a compromised Linux system `/tmp` directory. FIN13 also has used `attrib.exe` to hide gathered local host information.

COATHANGER creates and installs itself to a hidden installation directory.

NETWIRE can copy itself to and launch itself from hidden folders.

iKitten saves itself with a leading "." so that it's hidden from users by default.

EnvyScout can use hidden directories and files to hide malicious executables.

Machete has the capability to exfiltrate stolen data to a hidden folder on a removable drive.

Dacls has had its payload named with a dot prefix to make it hidden from view in the Finder application.

Cuckoo Stealer has copied its binary and the victim's scraped password into a hidden folder in the `/Users` directory.

WastedLocker has copied a random file from the Windows System32 folder to the %APPDATA% location under a different hidden filename.

InvisiMole can create hidden system directories.

CLAIMLOADER has modified file attributes to remain hidden to a standard user.

FruitFly saves itself with a leading "." to make it a hidden file.

Before exfiltration, Okrum's backdoor has used hidden files to store logs and outputs from backdoor commands.

REPTILE has the ability to communicate with the kernel-mode component to hide files.

Rising Sun can modify file attributes to hide files.

PlugX can modify the characteristics of folders to hide them from the compromised user. PlugX has also modified file attributes to hidden and system.

Explosive has commonly set file and path attributes to hidden.

Clambling has the ability to set its file attributes to hidden.

DarkGate initial installation involves dropping several files to a hidden directory named after the victim machine name. Additionally, DarkGate uses attrib to hide a directory in the following command: ` C:\Windows\system32\attrib.exe” +h C:/rjtu/`.

ThiefQuest hides a copy of itself in the user's ~/Library directory by using a . at the beginning of the file name followed by 9 random characters.

WannaCry uses attrib +h to make some of its files hidden.

Ixeshe sets its own executable file's attributes to hidden.

Micropsia creates a new hidden directory to store all components' outputs in a dedicated sub-folder for each.

Attor can set attributes of log files and directories to HIDDEN, SYSTEM, ARCHIVE, or a combination of those.

ccf32 has created a hidden directory on targeted systems, naming it after the current local time (year, month, and day).

OSX_OCEANLOTUS.D sets the main loader file’s attributes to hidden.

Calisto uses a hidden directory named .calisto to store data from the victim’s machine before exfiltration.

Carberp has created a hidden file in the Startup folder of the current user.

SysUpdate has the ability to set file attributes to hidden.

BackConfig has the ability to set folders or files to be hidden from the Windows Explorer default view.

Lokibot has the ability to copy itself to a hidden file and directory.

PoetRAT has the ability to hide and unhide files.

CoinTicker downloads the following hidden files to evade detection and maintain persistence: /private/tmp/.info.enc, /private/tmp/.info.py, /private/tmp/.server.sh, ~/Library/LaunchAgents/.espl.plist, ~/Library/Containers/.[random string]/[random string].

HIUPAN has modified registry keys to ensure hidden files and extensions are not visible through the modification of `HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced`.

XCSSET uses a hidden folder named .xcassets and .git to embed itself in Xcode.

AppleJeus has added a leading . to plist filenames, unlisting them from the Finder app and default Terminal directory listings.

Agent Tesla has created hidden folders.

QakBot has placed its payload in hidden subdirectories.

The Komplex payload is stored in a hidden directory at /Users/Shared/.local/kextd.

OSX/Shlayer has executed a .command script from a hidden directory in a mounted DMG.