MITRE ATT&CK - Техника Исследование файлов и каталогов

В сервис интегрированы наиболее популярные публичных базы знаний:

Сертификаты СЗИ - Государственный реестр сертифицированных средств защиты информации опубликованный Федеральной службой по техническому и экспортному контролю, может быть использован для контроля актуальности используемых СЗИ в организации.
CVE уязвимости - общедоступная публичная база уязвимостей Common Vulnerabilities and Exposures (CVE). Миссия программы CVE заключается в выявлении, определении и каталогизации публично раскрываемых уязвимостей в сфере кибербезопасности. Для каждой уязвимости в каталоге существует одна запись CVE. Уязвимости обнаруживаются, затем присваиваются и публикуются организациями по всему миру, которые сотрудничают с программой CVE. Партнеры публикуют записи CVE для единообразного описания уязвимостей. Специалисты в области информационных технологий и кибербезопасности используют записи CVE, чтобы убедиться, что они обсуждают одну и ту же проблему, и координировать свои усилия по определению приоритетности и устранению уязвимостей.
БДУ ФСТЭК уязвимости - раздел Уязвимости Банка данных уязвимостей опубликованная Федеральной службой по техническому и экспортному контролю совместно с Государственным научно-исследовательским испытательным институтом проблем технической защиты информации. Одной из целей создания банка данных угроз безопасности информации является объединение специалистов в области информационной безопасности для решения задач повышения защищенности информационных систем.
НКЦКИ уязвимости - общедоступная публичная база уязвимостей Национального координационного центра по компьютерным инцидентам (НКЦКИ), обеспечивающего координацию деятельности субъектов КИИ по обнаружению, предупреждению, ликвидации последствий компьютерных атак и реагированию на компьютерные инциденты.
MITRE ATT&CK – Adversarial Tactics, Techniques & Common Knowledge – Тактики, техники и общеизвестные знания о злоумышленниках. Это основанная на реальных наблюдениях база знаний компании Mitre, содержащая описание тактик, приемов и методов, используемых киберпреступниками. База создана в 2013 году и регулярно обновляется, цель – составление структурированной матрицы используемых киберпреступниками приемов, чтобы упростить задачу реагирования на киберинциденты.
БДУ ФСТЭК и Новая БДУ ФСТЭК – раздел Угрозы Банка данных угроз, опубликованный в 2015 году Федеральной службой по техническому и экспортному контролю и Государственным научно-исследовательским испытательным институтом проблем технической защиты информации, обязателен при моделировании угроз при построении систем защиты персональных данных, критической информационной инфраструктуры, государственных информационных систем.

CVE, БДУ ФСТЭК и НКЦКИ

Каталоги CVE уязвимости, БДУ ФСТЭК уязвимости и НКЦКИ уязвимости предоставляют дополнительный контент и обогащают информацией описание уязвимостей от сканеров в модуле Технические уязвимости.

Интерфейс каталогов идентичен и содержит следующие блоки:

Метрики:
- Найденные уязвимости – отображает количество найденных в отчетах от сканеров уязвимостей которые связаны с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей);
- Уязвимые хосты – отображает количество хостов на которых обнаружены уязвимости связанные с уязвимостями из каталога, при нажатии на виджет перенаправляет в модуль Технические уязвимости с установленным фильтром по названию каталога (тип фильтра Группа уязвимостей).
Табличную часть Каталог уязвимостей:
- Фильтр по полю Идентификатор - особенностью данного фильтра является автоматический разбор текста с последующим извлечением из текста идентификаторов. Для этого необходимо вставить произвольный текст с идентификаторами в поле и добавить в фильтр через кнопку плюс;
- Табличную часть с полями для каталогов CVE и БДУ ФСТЭК:
  - Идентификатор - id уязвимости в базе уязвимостей;
  - Описание - текстовое описание уязвимости;
  - Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
  - CVSS - числовая оценка уязвимости согласно источнику, с указанием даты выявления уязвимости экспертами, оценка отображается цветом согласно оценке CVSS 0.1 – 3.9 Low Зеленый,
    4.0 – 6.9 Medium Желтый, 7.0 – 8.9 High Оранжевый, 9.0 – 10.0 Critical Красный.
- Табличную часть с полями для каталогов CVE :
  - Дата бюллетеня - информация о дате публикации бюллетеня содержащего уязвимости;
  - Идентификатор - id уязвимости в базе уязвимостей;
  - Информация - текстовое описание уязвимости;
  - Вектор атаки - локальный или сетевой вектор атаки;
  - Обнаружено - флаг, данный статус отображается если уязвимость обнаружена в отчетах о сканировании;
  - Наличие обновления - - флаг, данный статус отображается если база уязвимостей содержит информацию о наличии обновлений от производителя уязвимого ПО;
  - Дата выявления - даты выявления уязвимости экспертами.
- Чекбокс «Только обнаруженные уязвимости» - устанавливает фильтр на табличную часть для отображения только обнаруженные уязвимости.
- Функционал для экспорта всех уязвимостей каталога.
- Для каталога добавляется функционал Варианты отображения:
  - Бюллетени - изменяет отображение табличной части на реестр бюллетеней, отображает общее количество уязвимостей в бюллетени в поле Уязвимостей в бюллетени и статус по обнаружению в поле Обнаружено - данный статус отображается если хотя бы одна уязвимость из бюллетеня обнаружена в инфраструктуре.
  - Уязвимости.

MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК

Данные из каталогов MITRE ATT&CK, БДУ ФСТЭК, Новая БДУ ФСТЭК могут использоваться для контекстного наполнения риска в модуле Риски.

Каждый из указанных каталогов сформирован по собственной схеме данных, которая не соответствует подходу оценки риска, используемому в сервисе. Но в основе своей указанные базы описывают все те же риски информационной безопасности, каждый под своим углом. Поэтому они добавлены в сервис и как отдельные компоненты и как основа для создания рисков, угроз или уязвимостей.

Каталоги могут использоваться в сервисе с целью:

Облегчения процесса формирования рисков, угроз и уязвимостей;
Обогащения информации по рискам (угрозам, уязвимостям) созданным в сервисе.
Взгляда на компанию и оценку рисков через публичные каталоги угроз.

Сервис позволяет установить связь между объектами из каталогов и 3 типами объектов сервиса: угрозами, уязвимостями или рисками безопасности:

Уязвимости могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK и способами реализации Новой БДУ ФСТЭК.
Угрозы могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами и последствиями Новой БДУ ФСТЭК.
Риски могут быть связаны с угрозами БДУ ФСТЭК, техниками ATT&CK, угрозами, способами реализации и последствиями Новой БДУ ФСТЭК.

Такой широкий выбор возможных связей сделан потому, что объекты из каталогов угроз могут быть или угрозой или уязвимостью в контексте сервиса.

Например, УБИ.004 Угроза аппаратного сброса пароля BIOS из БДУ ФСТЭК в контексте сервиса является уязвимостью, особенностью активов типа Микропрограммное обеспечение, которая может привести к реализации угрозы Несанкционированного локального доступа к BIOS.

В большинстве случаев угрозы из БДУ ФСТЭК и техники из MITRE ATT@CK являются именно уязвимостями, использование которых ведет к реализации угроз безопасности, но бывают и исключения.

Для рисков, угроз и уязвимостей из базы Community связи с каталогами угроз уже установлены.

Связь с каталогом угроз может быть прямой или косвенной. Например, если уязвимость связана с угрозой из БДУ ФСТЭК то и все риски, в составе которых есть данная уязвимость будут автоматически связаны с угрозой из БДУ ФСТЭК.

Каталог БДУ ФСТЭК - это реестр рисков от банка данных угроз безопасности информации ФСТЭК России.
Каждая угроза содержит описание, рекомендации к каким типам активов может быть применена эта угроза, классификация по свойствам информации и вероятные источники угрозы. Дополнительно в блоке Связанные риски указаны связанные риски, а в блоке Каталоги указываются связи с записями из других каталогов.

Каталог Новая БДУ ФСТЭК от банка данных угроз безопасности информации ФСТЭК России содержит:

матрицу Способы реализации (возникновения угроз) - каждая ячейка которых содержит описание поверхности атаки: группу способов, уровень возможностей нарушителя, возможные реализуемые угрозы, компоненты объектов воздействия, возможные меры защиты;
Негативные последствия - перечень негативных последствий в классификации ФСТЭК в виде кода и описания;
Угрозы - реестр угроз с описанием, каждая угроза содержит возможные объекты воздействия и возможные способы реализации угроз;
Объекты - перечень объектов последствий с описанием и компонентами которые могут входить в состав объекта;
Компоненты - перечень компонентов объектов воздействия с указанием объектов воздействия на которых они могут располагаться;
Нарушители - уровни возможностей нарушителей классифицированные по возможностям и компетенции;
Меры защиты - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя.

Каталог MITRE ATT&CK содержит:

Матрица - содержит тактики и техники злоумышленника, позволяет на основании тактики или техники создать риск или уязвимость, в матрице указаны связи с рисками в базе Community и с рисками в базе команды;
Тактики - направления действия нарушителя на том или ином этапе cyberkillchane;
Техники - конкретные действия нарушителя для достижения цели на конкретном шаге cyberkillchane;
Контрмеры - в терминологии SECURITM это список требований выполнение которых сокращает возможности нарушителя;
Преступные группы - описание APT группировок и их особенности и модель поведения;
Инструменты - ПО используемое нарушителями для вредоносного воздействия.

Матрицы могут использоваться для построения тепловой карты рисков наложенных на матрицы угроз и уязвимостей.

Сертификаты СЗИ

Каталог Сертификаты СЗИ может быть использован в модуле Активы как источник информации для поля Номер сертификата СЗИ. В модуле активов есть возможность вести реестр СЗИ используемых в организации, в свою очередь каталог сертификатов СЗИ позволяет связать актив с каталогом через поле актива Номер сертификата СЗИ.

Каталог Сертификаты СЗИ содержит реестр с информацией о номере сертификата, сроке действия сертификата и сроке поддержки СЗИ. Кроме реестра каталог содержит следующие метрики:

Имеющиеся СЗИ - отображает количество активов у которых заполнено поле Номер сертификата СЗИ;
Скоро будут просрочены - отображает количество активов у которых срок действия сертификата меньше 90 календарных дней;
Просроченные сертификаты - отображает количество активов у которых срок действия сертификата уже истек;
Истекшая поддержка - отображает количество активов у которых срок действия сертификата уже истек.

Каждая метрика ведёт в реестр активов и выводит список СЗИ, отфильтрованный по соответствующим параметрам.

Нажав на просмотр сертификата, мы увидим карточку сертификата, сервис хранит информацию о следующих данных:

Номер сертификата;
Дата внесения в реестр;
Срок действия сертификата;
Срок окончания тех. поддержки;
Наименование средства (шифр);
Схема сертификации;
Испытательная лаборатория;
Орган по сертификации;
Заявитель;
Наименования документов соответствия;
Реквизиты заявителя.

Реестр обновляется автоматически один раз в месяц.

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Исследование файлов и каталогов

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.

ID: T1083

Тактика(-и): Discovery

Платформы: ESXi, Linux, Network Devices, Windows, macOS

Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation

Версия: 1.7

Дата создания: 31 May 2017

Последнее изменение: 15 Apr 2025

Название	Описание
Примеры процедур
TrickBot	TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.(Citation: S2 Grupo TrickBot June 2017)(Citation: Trend Micro Trickbot Nov 2018)
PowerDuke	PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.(Citation: Volexity PowerDuke November 2016)
BLINDINGCAN	BLINDINGCAN can search, read, write, move, and execute files.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)
Ninja	Ninja has the ability to enumerate directory content.(Citation: Kaspersky ToddyCat June 2022)(Citation: Kaspersky ToddyCat Check Logs October 2023)
RemoteUtilities	RemoteUtilities can enumerate files and directories on a target machine.(Citation: Trend Micro Muddy Water March 2021)
QuietSieve	QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.(Citation: Microsoft Actinium February 2022)
SynAck	SynAck checks its directory location in an attempt to avoid launching in a sandbox.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
AcidRain	AcidRain identifies specific files and directories in the Linux operating system associated with storage devices.(Citation: AcidRain JAGS 2022)
Amadey	Amadey has searched for folders associated with antivirus software.(Citation: Korean FSI TA505 2020)
Proxysvc	Proxysvc lists files in directories.(Citation: McAfee GhostSecret)
Orz	Orz can gather victim drive information.(Citation: Proofpoint Leviathan Oct 2017)
yty	yty gathers information on victim’s drives and has a plugin for document listing.(Citation: ASERT Donot March 2018)
Backdoor.Oldrea	Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.(Citation: Symantec Dragonfly)
Stuxnet	Stuxnet uses a driver to scan for specific filesystem driver objects.(Citation: Nicolas Falliere, Liam O Murchu, Eric Chien February 2011)
AvosLocker	AvosLocker has searched for files and directories on a compromised network.(Citation: Malwarebytes AvosLocker Jul 2021)(Citation: Trend Micro AvosLocker Apr 2022)
POWRUNER	POWRUNER may enumerate user directories on a victim.(Citation: FireEye APT34 Dec 2017)
COATHANGER	COATHANGER will survey the contents of system files during installation.(Citation: NCSC-NL COATHANGER Feb 2024)
Smoke Loader	Smoke Loader recursively searches through directories for files.(Citation: Talos Smoke Loader July 2018)
WindTail	WindTail has the ability to enumerate the users home directory and the path to its own application bundle.(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)
Misdat	Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.(Citation: Cylance Dust Storm)
KEYMARBLE	KEYMARBLE has a command to search for files on the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)
Sliver	Sliver can enumerate files on a target system.(Citation: GitHub Sliver File System August 2021)
SILENTTRINITY	SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.(Citation: GitHub SILENTTRINITY Modules July 2019)
ThreatNeedle	ThreatNeedle can obtain file and directory information.(Citation: Kaspersky ThreatNeedle Feb 2021)
RansomHub	RansomHub has the ability to only encrypt specific files.(Citation: Group-IB RansomHub FEB 2025)
ZLib	ZLib has the ability to enumerate files and drives.(Citation: Cylance Dust Storm)
RedLeaves	RedLeaves can enumerate and search for files and directories.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)
LITTLELAMB.WOOLTEA	LITTLELAMB.WOOLTEA can monitor for system upgrade events by checking for the presence of `/tmp/data/root/dev`.(Citation: Mandiant Cutting Edge Part 3 February 2024)
Zeus Panda	Zeus Panda searches for specific directories on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
GeminiDuke	GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.(Citation: F-Secure The Dukes)
GravityRAT	GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.(Citation: Talos GravityRAT)
Prestige	Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.(Citation: Microsoft Prestige ransomware October 2022)
Bankshot	Bankshot searches for files on the victim's machine.(Citation: US-CERT Bankshot Dec 2017)
SharpDisco	SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either `%USERPROFILE%\Recent` (Windows XP) or `%APPDATA%\Microsoft\Windows\Recent` (newer Windows versions) .(Citation: MoustachedBouncer ESET August 2023)
StrongPity	StrongPity can parse the hard drive on a compromised host to identify specific file extensions.(Citation: Talos Promethium June 2020)
WinMM	WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.(Citation: Baumgartner Naikon 2015)
Nebulae	Nebulae can list files and directories on a compromised host.(Citation: Bitdefender Naikon April 2021)
AuditCred	AuditCred can search through folders and files on the system.(Citation: TrendMicro Lazarus Nov 2018)
Kasidet	Kasidet has the ability to search for a given filename on a victim.(Citation: Zscaler Kasidet)
OceanSalt	OceanSalt can extract drive information from the endpoint and search files on the system.(Citation: McAfee Oceansalt Oct 2018)
Playcrypt	Playcrypt can avoid encrypting files with a .PLAY, .exe, .msi, .dll, .lnk, or .sys file extension.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
Brave Prince	Brave Prince gathers file and directory information from the victim’s machine.(Citation: McAfee Gold Dragon)
RainyDay	RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.(Citation: Bitdefender Naikon April 2021)
AppleSeed	AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.(Citation: Malwarebytes Kimsuky June 2021)
NETWIRE	NETWIRE has the ability to search for files on the compromised host.(Citation: Proofpoint NETWIRE December 2020)
CosmicDuke	CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.(Citation: F-Secure Cosmicduke)
Gomir	Gomir collects information about directory and file structures, including total number of subdirectories, total number of files, and total size of files on infected systems.(Citation: Symantec Troll Stealer 2024)
Aria-body	Aria-body has the ability to gather metadata from a file and to search for file and directory names.(Citation: CheckPoint Naikon May 2020)
BOLDMOVE	BOLDMOVE can list information of all files in the system recursively from the root directory or from a specified directory.(Citation: Google Cloud BOLDMOVE 2023)
Crimson	Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
DUSTTRAP	DUSTTRAP can enumerate files and directories.(Citation: Google Cloud APT41 2024)
Empire	Empire includes various modules for finding files of interest on hosts and network shares.(Citation: Github PowerShell Empire)
Turian	Turian can search for specific files and list directories.(Citation: ESET BackdoorDiplomacy Jun 2021)
Machete	Machete produces file listings in order to search for files to be exfiltrated.(Citation: ESET Machete July 2019)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)
Action RAT	Action RAT has the ability to collect drive and file information on an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)
Avenger	Avenger has the ability to browse files in directories such as Program Files and the Desktop.(Citation: Trend Micro Tick November 2019)
Prikormka	A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.(Citation: ESET Operation Groundbait)
PingPull	PingPull can enumerate storage volumes and folder contents of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
Dacls	Dacls can scan directories on a compromised host.(Citation: TrendMicro macOS Dacls May 2020)
DropBook	DropBook can collect the names of all files and folders in the Program Files directories.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
Woody RAT	Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.(Citation: MalwareBytes WoodyRAT Aug 2022)
Mafalda	Mafalda can search for files and directories.(Citation: SentinelLabs Metador Sept 2022)
ELMER	ELMER is capable of performing directory listings.(Citation: FireEye EPS Awakens Part 2)
SombRAT	SombRAT can execute `enum` to enumerate files in storage on a compromised system.(Citation: BlackBerry CostaRicto November 2020)
ODAgent	ODAgent can identify the current working directory.(Citation: ESET OilRig Downloaders DEC 2023)
FLASHFLOOD	FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.(Citation: FireEye APT30)
FYAnti	FYAnti can search the `C:\Windows\Microsoft.NET\` directory for files of a specified size.(Citation: Securelist APT10 March 2021)
LoFiSe	LoFiSe can monitor the file system to identify files less than 6.4 MB in size with file extensions including .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pdf, .rtf, .tif, .odt, .ods, .odp, .eml, and .msg.(Citation: Kaspersky ToddyCat Check Logs October 2023)
HOPLIGHT	HOPLIGHT has been observed enumerating system drives and partitions.(Citation: US-CERT HOPLIGHT Apr 2019)
Cuckoo Stealer	Cuckoo Stealer can search for files associated with specific applications.(Citation: Kandji Cuckoo April 2024)(Citation: SentinelOne Cuckoo Stealer May 2024)
MobileOrder	MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.(Citation: Scarlet Mimic Jan 2016)
WastedLocker	WastedLocker can enumerate files and directories just prior to encryption.(Citation: NCC Group WastedLocker June 2020)
InvisiMole	InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.(Citation: ESET InvisiMole June 2018)
P.A.S. Webshell	P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.(Citation: ANSSI Sandworm January 2021)
Volgmer	Volgmer can list directories on a victim.(Citation: US-CERT Volgmer Nov 2017)
WINERACK	WINERACK can enumerate files and directories.(Citation: FireEye APT37 Feb 2018)
WhisperGate	WhisperGate can locate files based on hardcoded file extensions.(Citation: Microsoft WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
FruitFly	FruitFly looks for specific files and file types.(Citation: objsee mac malware 2017)
AcidPour	AcidPour can identify specific files and directories within the Linux operating system corresponding with storage devices for follow-on wiping activity, similar to AcidRain.(Citation: SentinelOne AcidPour 2024)
PoshC2	PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.(Citation: GitHub PoshC2)
Skidmap	Skidmap has checked for the existence of specific files including `/usr/sbin/setenforce` and `/etc/selinux/config`. It also has the ability to monitor the cryptocurrency miner file and process. (Citation: Trend Micro Skidmap)
Okrum	Okrum has used DriveLetterView to enumerate drive information.(Citation: ESET Okrum July 2019)
Conti	Conti can discover files on a local system.(Citation: CarbonBlack Conti July 2020)
Raspberry Robin	Raspberry Robin will check to see if the initial executing script is located on the user's Desktop as an anti-analysis check.(Citation: HP RaspberryRobin 2024)
Mispadu	Mispadu searches for various filesystem paths to determine what banking applications are installed on the victim’s machine.(Citation: ESET Security Mispadu Facebook Ads 2019)
Megazord	Megazord can ignore specified directories for encryption.(Citation: Palo Alto Howling Scorpius DEC 2024)
Diavol	Diavol has a command to traverse the files and directories in a given path.(Citation: Fortinet Diavol July 2021)
Doki	Doki has resolved the path of a process PID to use as a script argument.(Citation: Intezer Doki July 20)
Siloscape	Siloscape searches for the Kubernetes config file and other related files using a regular expression.(Citation: Unit 42 Siloscape Jun 2021)
BlackCat	BlackCat can enumerate files for encryption.(Citation: Microsoft BlackCat Jun 2022)
Fysbis	Fysbis has the ability to search for files.(Citation: Fysbis Dr Web Analysis)
MarkiRAT	MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Kazuar	Kazuar finds a specified directory, lists the files and metadata about those files.(Citation: Unit 42 Kazuar May 2017)
NETEAGLE	NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.(Citation: FireEye APT30)
POORAIM	POORAIM can conduct file browsing.(Citation: FireEye APT37 Feb 2018)
CHIMNEYSWEEP	CHIMNEYSWEEP has the ability to enumerate directories for files that match a set list.(Citation: Mandiant ROADSWEEP August 2022)
FatDuke	FatDuke can enumerate directories on target machines.(Citation: ESET Dukes October 2019)
BlackEnergy	BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)
zwShell	zwShell can browse the file system.(Citation: McAfee Night Dragon)
Rising Sun	Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.(Citation: McAfee Sharpshooter December 2018)
NotPetya	NotPetya searches for files ending with dozens of different file extensions prior to encryption.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
ShimRat	ShimRat can list directories.(Citation: FOX-IT May 2016 Mofang)
BADFLICK	BADFLICK has searched for files on the infected host.(Citation: Accenture MUDCARP March 2019)
ObliqueRAT	ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.(Citation: Talos Oblique RAT March 2021)
SHOTPUT	SHOTPUT has a command to obtain a directory listing.(Citation: Palo Alto CVE-2015-3113 July 2015)
Avaddon	Avaddon has searched for specific files prior to encryption.(Citation: Arxiv Avaddon Feb 2021)
Rclone	Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.(Citation: Rclone)
XAgentOSX	XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.(Citation: XAgentOSX 2017) XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running `ls -la ~/Library/Application\ Support/MobileSync/Backup/`.(Citation: XAgentOSX 2017)
China Chopper	China Chopper's server component can list directory contents.(Citation: FireEye Periscope March 2018)(Citation: Rapid7 HAFNIUM Mar 2021)
LightSpy	LightSpy uses the `NSFileManager` to move, create and delete files. LightSpy can also use the assembly `bt` instruction to determine a file's executable permissions.(Citation: Huntress LightSpy macOS 2024)
Cheerscrypt	Cheerscrypt can search for log and VMware-related files with .log, .vmdk, .vmem, .vswp, and .vmsn extensions.(Citation: Trend Micro Cheerscrypt May 2022)
KeyBoy	KeyBoy has a command to launch a file browser or explorer on the system.(Citation: PWC KeyBoys Feb 2017)
MiniDuke	MiniDuke can enumerate local drives.(Citation: ESET Dukes October 2019)
Pteranodon	Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.(Citation: Palo Alto Gamaredon Feb 2017)
ROKRAT	ROKRAT has the ability to gather a list of files and directories on the infected system.(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)
Babuk	Babuk has the ability to enumerate files on a targeted system.(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)
Exbyte	Exbyte enumerates all document files on an infected machine, then creates a summary of these items including filename and directory location prior to exfiltration to cloud hosting services.(Citation: Symantec BlackByte 2022)
DarkWatchman	DarkWatchman has the ability to enumerate file and folder names.(Citation: Prevailion DarkWatchman 2021)
BlackMould	BlackMould has the ability to find files on the targeted system.(Citation: Microsoft GALLIUM December 2019)
PACEMAKER	PACEMAKER can parse `/proc/"process_name"/cmdline` to look for the string `dswsd` within the command line.(Citation: Mandiant Pulse Secure Zero-Day April 2021)
BBSRAT	BBSRAT can list file and directory information.(Citation: Palo Alto Networks BBSRAT)
PlugX	PlugX has a module to enumerate drives and find files recursively.(Citation: CIRCL PlugX March 2013)(Citation: Proofpoint TA416 Europe March 2022)
Bisonal	Bisonal can retrieve a file listing from the system.(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
MultiLayer Wiper	MultiLayer Wiper generates a list of all files and paths on the fixed drives of an infected system, enumerating all files on the system except specific folders defined in a hardcoded list.(Citation: Unit42 Agrius 2023)
DustySky	DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)
Remsec	Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)
Rover	Rover automatically searches for files on local drives based on a predefined list of file extensions.(Citation: Palo Alto Rover)
Epic	Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
Peppy	Peppy can identify specific files for exfiltration.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Cuba	Cuba can enumerate files by using a variety of functions.(Citation: McAfee Cuba April 2021)
DEATHRANSOM	DEATHRANSOM can use loop operations to enumerate directories on a compromised host.(Citation: FireEye FiveHands April 2021)
Clambling	Clambling can browse directories on a compromised host.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
Akira	Akira examines files prior to encryption to determine if they meet requirements for encryption and can be encrypted by the ransomware. These checks are performed through native Windows functions such as `GetFileAttributesW`.(Citation: Kersten Akira 2023)(Citation: Cisco Akira Ransomware OCT 2024)
DarkGate	Some versions of DarkGate search for the hard-coded folder `C:\Program Files\e Carte Bleue`.(Citation: Ensilo Darkgate 2018)
LockBit 3.0	LockBit 3.0 can exclude files associated with core system functions from encryption.(Citation: Joint Cybersecurity Advisory LockBit 3.0 MAR 2023)
FoggyWeb	FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
Hydraq	Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
CreepyDrive	CreepyDrive can specify the local file path to upload files from.(Citation: Microsoft POLONIUM June 2022)
Caterpillar WebShell	Caterpillar WebShell can search for files in directories.(Citation: ClearSky Lebanese Cedar Jan 2021)
Elise	A variant of Elise executes `dir C:\progra~1` when initially run.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
USBferry	USBferry can detect the victim's file or folder list.(Citation: TrendMicro Tropic Trooper May 2020)
WannaCry	WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)
TSCookie	TSCookie has the ability to discover drive information on the infected host.(Citation: JPCert TSCookie March 2018)
Latrodectus	Latrodectus can collect desktop filenames.(Citation: Latrodectus APR 2024)(Citation: Bitsight Latrodectus June 2024)(Citation: Elastic Latrodectus May 2024)
Saint Bot	Saint Bot can search a compromised host for specific files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
CharmPower	CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.(Citation: Check Point APT35 CharmPower January 2022)
TYPEFRAME	TYPEFRAME can search directories for files on the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018)
3PARA RAT	3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.(Citation: CrowdStrike Putter Panda)
Remcos	Remcos can search for files on the infected machine.(Citation: Riskiq Remcos Jan 2018)
TAINTEDSCRIBE	TAINTEDSCRIBE can use `DirectoryList` to enumerate files in a specified directory.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
Royal	Royal can identify specific files and directories to exclude from the encryption process.(Citation: Cybereason Royal December 2022)(Citation: Kroll Royal Deep Dive February 2023)(Citation: Trend Micro Royal Linux ESXi February 2023)
Uroburos	Uroburos can search for specific files on a compromised system.(Citation: Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023)
Metamorfo	Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)(Citation: FireEye Metamorfo Apr 2018)
Spica	Spica can list filesystem contents on targeted systems.(Citation: Google TAG COLDRIVER January 2024)
Trojan.Karagany	Trojan.Karagany can enumerate files and directories on a compromised host.(Citation: Secureworks Karagany July 2019)
Bandook	Bandook has a command to list files on a system.(Citation: CheckPoint Bandook Nov 2020)
TINYTYPHON	TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.(Citation: Forcepoint Monsoon)
KONNI	A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.(Citation: Talos Konni May 2017)
CORALDECK	CORALDECK searches for specified files.(Citation: FireEye APT37 Feb 2018)
SPACESHIP	SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.(Citation: FireEye APT30)
BLUELIGHT	BLUELIGHT can enumerate files and collect associated metadata.(Citation: Volexity InkySquid BLUELIGHT August 2021)
KGH_SPY	KGH_SPY can enumerate files and directories on a compromised host.(Citation: Cybereason Kimsuky November 2020)
down_new	down_new has the ability to list the directories on a compromised host.(Citation: Trend Micro Tick November 2019)
Ixeshe	Ixeshe can list file and directory information.(Citation: Trend Micro IXESHE 2012)
Micropsia	Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.(Citation: Radware Micropsia July 2018)
RARSTONE	RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.(Citation: Camba RARSTONE)
Black Basta	Black Basta can enumerate specific files for encryption.(Citation: Cyble Black Basta May 2022)(Citation: Avertium Black Basta June 2022)(Citation: NCC Group Black Basta June 2022)(Citation: Uptycs Black Basta ESXi June 2022)(Citation: Deep Instinct Black Basta August 2022)(Citation: Palo Alto Networks Black Basta August 2022)(Citation: Trend Micro Black Basta Spotlight September 2022)(Citation: Check Point Black Basta October 2022)
4H RAT	4H RAT has the capability to obtain file and directory listings.(Citation: CrowdStrike Putter Panda)
Attor	Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.(Citation: ESET Attor Oct 2019)
Imminent Monitor	Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.(Citation: QiAnXin APT-C-36 Feb2019)
MegaCortex	MegaCortex can parse the available drives and directories to determine which files to encrypt.(Citation: IBM MegaCortex)
Forfiles	Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)(Citation: Überwachung APT28 Forfiles June 2015)
StreamEx	StreamEx has the ability to enumerate drive types.(Citation: Cylance Shell Crew Feb 2017)
BoxCaon	BoxCaon has searched for files on the system, such as documents located in the desktop folder.(Citation: Checkpoint IndigoZebra July 2021)
NightClub	NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.(Citation: MoustachedBouncer ESET August 2023)
Akira _v2	Akira _v2 can target specific files and folders for encryption.(Citation: CISA Akira Ransomware APR 2024)(Citation: Cisco Akira Ransomware OCT 2024)(Citation: Palo Alto Howling Scorpius DEC 2024)
SDBbot	SDBbot has the ability to get directory listings or drive information on a compromised host.(Citation: Proofpoint TA505 October 2019)
RTM	RTM can check for specific files and directories associated with virtualization and malware analysis.(Citation: Unit42 Redaman January 2019)
Derusbi	Derusbi is capable of obtaining directory, file, and drive listings.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
Bazar	Bazar can enumerate the victim's desktop.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
BadPatch	BadPatch searches for files with specific file extensions.(Citation: Unit 42 BadPatch Oct 2017)
MESSAGETAP	MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.(Citation: FireEye MESSAGETAP October 2019)
SUGARDUMP	SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.(Citation: Mandiant UNC3890 Aug 2022)
SOUNDBITE	SOUNDBITE is capable of enumerating and manipulating files and directories.(Citation: FireEye APT32 May 2017)
MoonWind	MoonWind has a command to return a directory listing for a specified directory.(Citation: Palo Alto MoonWind March 2017)
Ryuk	Ryuk has enumerated files and folders on all mounted drives.(Citation: CrowdStrike Ryuk January 2019)
Cryptoistic	Cryptoistic can scan a directory to identify files for deletion.(Citation: SentinelOne Lazarus macOS July 2020)
HermeticWiper	HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)
ccf32	ccf32 can parse collected files to identify specific file extensions.(Citation: Bitdefender FunnyDream Campaign November 2020)
LockBit 2.0	LockBit 2.0 can exclude files associated with core system functions from encryption.(Citation: FBI Lockbit 2.0 FEB 2022)
Zebrocy	Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the `echo %APPDATA%` command to list the contents of the directory.(Citation: Securelist Sofacy Feb 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019) Zebrocy can obtain the current execution path as well as perform drive enumeration.(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
FinFisher	FinFisher enumerates directories and scans for certain files.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
LunarMail	LunarMail can search its staging directory for output files it has produced.(Citation: ESET Turla Lunar toolset May 2024)
CrossRAT	CrossRAT can list all files on a system.(Citation: Lookout Dark Caracal Jan 2018)
OwaAuth	OwaAuth has a command to list its directory and logical drives.(Citation: Dell TG-3390)
Cobalt Strike	Cobalt Strike can explore files on a compromised system.(Citation: Cobalt Strike Manual 4.3 November 2020)
SUNBURST	SUNBURST had commands to enumerate files and directories.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
HotCroissant	HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.(Citation: Carbon Black HotCroissant April 2020)
REvil	REvil has the ability to identify specific files and directories that are not to be encrypted.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)
Samurai	Samurai can use a specific module for file enumeration.(Citation: Kaspersky ToddyCat June 2022)
PinchDuke	PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.(Citation: F-Secure The Dukes)
USBStealer	USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.(Citation: ESET Sednit USBStealer 2014)(Citation: Kaspersky Sofacy)
Taidoor	Taidoor can search for specific files.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
Kivars	Kivars has the ability to list drives on the infected host.(Citation: TrendMicro BlackTech June 2017)
CaddyWiper	CaddyWiper can enumerate all files and directories on a compromised host.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Cyclops Blink	Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.(Citation: NCSC Cyclops Blink February 2022)(Citation: Trend Micro Cyclops Blink March 2022)
Seasalt	Seasalt has the capability to identify the drive type on a victim.(Citation: McAfee Oceansalt Oct 2018)
TajMahal	TajMahal has the ability to index files from drives, user profiles, and removable drives.(Citation: Kaspersky TajMahal April 2019)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of files.(Citation: Symantec Pasam May 2012)
PLEAD	PLEAD has the ability to list drives and files on the compromised host.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018)
Raccoon Stealer	Raccoon Stealer identifies target files and directories for collection based on a configuration file.(Citation: S2W Racoon 2022)(Citation: Sekoia Raccoon2 2022)
Cardinal RAT	Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).(Citation: PaloAlto CardinalRat Apr 2017)
Pisloader	Pisloader has commands to list drives on the victim machine and to list file information for a given directory.(Citation: Palo Alto DNS Requests)
GoldenSpy	GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.(Citation: Trustwave GoldenSpy June 2020)
Gold Dragon	Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.(Citation: McAfee Gold Dragon)
Ramsay	Ramsay can collect directory and file lists.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
cmd	cmd can be used to find files and directories with native functionality such as `dir` commands.(Citation: TechNet Dir)
MacMa	MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.(Citation: ESET DazzleSpy Jan 2022)
FunnyDream	FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.(Citation: Bitdefender FunnyDream Campaign November 2020)
ROADSWEEP	ROADSWEEP can enumerate files on infected devices and avoid encrypting files with .exe, .dll, .sys, .lnk, or . lck extensions.(Citation: Mandiant ROADSWEEP August 2022)(Citation: CISA Iran Albanian Attacks September 2022)(Citation: Microsoft Albanian Government Attacks September 2022)
SUNSPOT	SUNSPOT enumerated the Orion software Visual Studio solution directory path.(Citation: CrowdStrike SUNSPOT Implant January 2021)
SysUpdate	SysUpdate can search files on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)(Citation: Lunghi Iron Tiger Linux)
OutSteel	OutSteel can search for specific file extensions, including zipped files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
BackConfig	BackConfig has the ability to identify folders and files related to previous infections.(Citation: Unit 42 BackConfig May 2020)
Kwampirs	Kwampirs collects a list of files and directories in C:\ with the command `dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp"`.(Citation: Symantec Orangeworm April 2018)
BoomBox	BoomBox can search for specific files and directories on a machine.(Citation: MSTIC Nobelium Toolset May 2021)
CrackMapExec	CrackMapExec can discover specified filetypes and log files on a targeted system.(Citation: CME Github September 2018)
Mango	Mango can enumerate the contents of current working or other specified directories.(Citation: ESET OilRig Campaigns Sep 2023)
Koadic	Koadic can obtain a list of directories.(Citation: MalwareBytes LazyScripter Feb 2021)
InnaputRAT	InnaputRAT enumerates directories and obtains file attributes on a system.(Citation: ASERT InnaputRAT April 2018)
GrimAgent	GrimAgent has the ability to enumerate files and directories on a compromised host.(Citation: Group IB GrimAgent July 2021)
LookBack	LookBack can retrieve file listings from the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)
Clop	Clop has searched folders and subfolders for files to encrypt.(Citation: Mcafee Clop Aug 2019)
Pupy	Pupy can walk through directories and recursively search for strings in files.(Citation: GitHub Pupy)
Lokibot	Lokibot can search for specific files on an infected host.(Citation: Talos Lokibot Jan 2021)
PoetRAT	PoetRAT has the ability to list files upon receiving the `ls` command from C2.(Citation: Talos PoetRAT April 2020)
CHOPSTICK	An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.(Citation: ESET Sednit Part 2)
StealBit	StealBit can be configured to exfiltrate specific file types.(Citation: FBI Lockbit 2.0 FEB 2022)(Citation: Cybereason StealBit Exfiltration Tool)
ZxShell	ZxShell has a command to open a file manager and explorer on the system.(Citation: Talos ZxShell Oct 2014)
NDiskMonitor	NDiskMonitor can obtain a list of all files and directories as well as logical drives.(Citation: TrendMicro Patchwork Dec 2017)
DDKONG	DDKONG lists files on the victim’s machine.(Citation: Rancor Unit42 June 2018)
Penquin	Penquin can use the command code `do_vslist` to send file names, size, and status to C2.(Citation: Leonardo Turla Penquin May 2020)
BabyShark	BabyShark has used `dir` to search for "programfiles" and "appdata".(Citation: Unit42 BabyShark Feb 2019)
Cannon	Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.(Citation: Unit42 Cannon Nov 2018)
Winnti for Windows	Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.(Citation: Novetta Winnti April 2015)
Troll Stealer	Troll Stealer can enumerate and collect items from local drives and folders.(Citation: S2W Troll Stealer 2024)
BLACKCOFFEE	BLACKCOFFEE has the capability to enumerate files.(Citation: FireEye APT17)
Ebury	Ebury can list directory entries.(Citation: ESET Ebury Oct 2017)
Kinsing	Kinsing has used the find command to search for specific files.(Citation: Aqua Kinsing April 2020)
njRAT	njRAT can browse file systems using a file manager module.(Citation: Fidelis njRAT June 2013)
ZIPLINE	ZIPLINE can find and append specific files on Ivanti Connect Secure VPNs based upon received commands.(Citation: Mandiant Cutting Edge January 2024)
ChChes	ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.(Citation: FireEye APT10 April 2017)
Manjusaka	Manjusaka can gather information about specific files on the victim system.(Citation: Talos Manjusaka 2022)
IceApple	The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.(Citation: CrowdStrike IceApple May 2022)
JPIN	JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.(Citation: Microsoft PLATINUM April 2016)
metaMain	metaMain can recursively enumerate files in an operator-provided directory.(Citation: SentinelLabs Metador Sept 2022)(Citation: SentinelLabs Metador Technical Appendix Sept 2022)
SideTwist	SideTwist has the ability to search for specific files.(Citation: Check Point APT34 April 2021)
Psylo	Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.(Citation: Scarlet Mimic Jan 2016)
Heyoka Backdoor	Heyoka Backdoor has the ability to search the compromised host for files.(Citation: SentinelOne Aoqin Dragon June 2022)
HTTPBrowser	HTTPBrowser is capable of listing files, folders, and drives on a victim.(Citation: Dell TG-3390)(Citation: ZScaler Hacking Team)
LunarWeb	LunarWeb has the ability to retrieve directory listings.(Citation: ESET Turla Lunar toolset May 2024)
XCSSET	XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions and leverages a module to run the command `ls -la ~/Desktop`.(Citation: Application Bundle Manipulation Brandon Dalton)(Citation: Microsoft March 2025 XCSSET)
Octopus	Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
KillDisk	KillDisk has used the `FindNextFile` command as part of its file deletion process.(Citation: Trend Micro KillDisk 2)
SoreFang	SoreFang has the ability to list directories.(Citation: CISA SoreFang July 2016)
Industroyer	Industroyer’s data wiper component enumerates specific files on all the Windows drives.(Citation: ESET Industroyer)
Pcexter	Pcexter has the ability to search for files in specified directories.(Citation: Kaspersky ToddyCat Check Logs October 2023)
BADNEWS	BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.(Citation: TrendMicro Patchwork Dec 2017)
Linfo	Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.(Citation: Symantec Linfo May 2012)
Remexi	Remexi searches for files on the system. (Citation: Securelist Remexi Jan 2019)
QakBot	QakBot can identify whether it has been run previously on a host by checking for a specified folder.(Citation: ATT QakBot April 2021)
CookieMiner	CookieMiner has looked for files in the user's home directory with "wallet" in their name using `find`.(Citation: Unit42 CookieMiner Jan 2019)
Gelsemium	Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.(Citation: ESET Gelsemium June 2021)
jRAT	jRAT can browse file systems.(Citation: Kaspersky Adwind Feb 2016)(Citation: Symantec Frutas Feb 2013)
OSX/Shlayer	OSX/Shlayer has used the command `appDir="$(dirname $(dirname "$currentDir"))"` and `$(dirname "$(pwd -P)")` to construct installation paths.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)
Denis	Denis has several commands to search directories for files.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
INC Ransomware	INC Ransomware can receive command line arguments to encrypt specific files and directories.(Citation: Cybereason INC Ransomware November 2023)(Citation: SentinelOne INC Ransomware)
FIVEHANDS	FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)
AutoIt backdoor	AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.(Citation: Forcepoint Monsoon)
Dtrack	Dtrack can list files on available disk volumes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
Azorult	Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.(Citation: Unit42 Azorult Nov 2018)
BACKSPACE	BACKSPACE allows adversaries to search for files.(Citation: FireEye APT30)
Zox	Zox can enumerate files on a compromised host.(Citation: Novetta-Axiom)
UPPERCUT	UPPERCUT has the capability to gather the victim's current directory.(Citation: FireEye APT10 Sept 2018)
ADVSTORESHELL	ADVSTORESHELL can list files and directories.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)
StrifeWater	StrifeWater can enumerate files on a compromised host.(Citation: Cybereason StrifeWater Feb 2022)
WarzoneRAT	WarzoneRAT can enumerate directories on a compromise host.(Citation: Check Point Warzone Feb 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA can enumerate files and directories.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
FALLCHILL	FALLCHILL can search files on a victim.(Citation: US-CERT FALLCHILL Nov 2017)
APT28	APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)
Turla	Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020) Turla RPC backdoors have also searched for files matching the `lPH*.dll` pattern.(Citation: ESET Turla PowerShell May 2019)
Tropic Trooper	Tropic Trooper has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)
Operation Wocao	Operation Wocao has gathered a recursive directory listing to find files and directories of interest.(Citation: FoxIT Wocao December 2019)
Fox Kitten	Fox Kitten has used WizTree to obtain network files and directory listings.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
Lazarus Group	Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
Gamaredon Group	Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)
APT29	APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.(Citation: Volexity SolarWinds)
Scattered Spider	Scattered Spider Spider enumerates a target organization for files and directories of interest, including source code.(Citation: CISA Scattered Spider Advisory November 2023)(Citation: MSTIC Octo Tempest Operations October 2023)
Darkhotel	Darkhotel has used malware that searched for files with specific patterns.(Citation: Microsoft DUBNIUM July 2016)
APT39	APT39 has used tools with the ability to search for files on a compromised host.(Citation: FBI FLASH APT39 September 2020)
APT38	APT38 have enumerated files and directories, or searched in specific locations within a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)
MuddyWater	MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."(Citation: Securelist MuddyWater Oct 2018)
Dragonfly 2.0	Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)
BRONZE BUTLER	BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.(Citation: Secureworks BRONZE BUTLER Oct 2017)
Honeybee	Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.(Citation: McAfee Honeybee)
Confucius	Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.(Citation: TrendMicro Confucius APT Aug 2021)
APT32	APT32's backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLotus Mar 2019)
Dragonfly	Dragonfly has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)
Sidewinder	Sidewinder has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)
LuminousMoth	LuminousMoth has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.(Citation: Kaspersky LuminousMoth July 2021)(Citation: Bitdefender LuminousMoth July 2021)
Inception	Inception used a file listing plugin to collect information about file and directories both on local and remote drives.(Citation: Symantec Inception Framework March 2018)
Chimera	Chimera has utilized multiple commands to identify data of interest in file and directory listings.(Citation: NCC Group Chimera January 2021)
Volt Typhoon	Volt Typhoon has enumerated directories containing vulnerability testing and cyber related content and facilities data such as construction drawings.(Citation: CISA AA24-038A PRC Critical Infrastructure February 2024)
FIN13	FIN13 has used the Windows `dir` command to enumerate files and directories in a victim's network.(Citation: Mandiant FIN13 Aug 2022)
Kimsuky	Kimsuky has the ability to enumerate all files and directories on an infected system.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)
Dust Storm	Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.(Citation: Cylance Dust Storm)
Sandworm Team	Sandworm Team has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)
APT18	APT18 can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016)
Velvet Ant	Velvet Ant has enumerated local files and folders on victim devices.(Citation: Sygnia VelvetAnt 2024A)
Magic Hound	Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.(Citation: Unit 42 Magic Hound Feb 2017)
Winnti Group	Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.(Citation: Kaspersky Winnti April 2013)
menuPass	menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.(Citation: Symantec Cicada November 2020)
Aoqin Dragon	Aoqin Dragon has run scripts to identify file formats including Microsoft Word.(Citation: SentinelOne Aoqin Dragon June 2022)
TeamTNT	TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.(Citation: Cisco Talos Intelligence Group)
Windigo	Windigo has used a script to check for the presence of files created by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)
ToddyCat	ToddyCat has run scripts to enumerate recently modified documents having either a .pdf, .doc, .docx, .xls or .xlsx extension.(Citation: Kaspersky ToddyCat Check Logs October 2023)
Ke3chang	Ke3chang uses command-line interaction to search files and directories.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)
Sowbug	Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.(Citation: Symantec Sowbug Nov 2017)
APT5	APT5 has used the BLOODMINE utility to discover files with .css, .jpg, .png, .gif, .ico, .js, and .jsp extensions in Pulse Secure Connect logs.(Citation: Mandiant Pulse Secure Update May 2021)
Patchwork	A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)
Mustang Panda	Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citation: Avira Mustang Panda January 2020)
RedCurl	RedCurl has searched for and collected files on local and network drives.(Citation: therecord_redcurl)(Citation: group-ib_redcurl1)(Citation: group-ib_redcurl2)
Leafminer	Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.(Citation: Symantec Leafminer July 2018)
Play	Play has used the Grixba information stealer to list security files and processes.(Citation: Trend Micro Ransomware Spotlight Play July 2023)
APT3	APT3 has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)
Winter Vivern	Winter Vivern delivered malicious JavaScript payloads capable of listing folders and emails in exploited email servers.(Citation: ESET WinterVivern 2023)
Lotus Blossom	Lotus Blossom has used commands such as `dir` to examine the local filesystem of victim machines.(Citation: Cisco LotusBlossom 2025)
APT41	APT41 has executed `file /bin/pwd` on exploited victims, perhaps to return architecture related information.(Citation: FireEye APT41 March 2020)
Dark Caracal	Dark Caracal collected file listings of all default Windows directories.(Citation: Lookout Dark Caracal Jan 2018)
UNC2452	UNC2452 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.(Citation: Volexity SolarWinds)
HAFNIUM	HAFNIUM has searched file contents on a compromised host.(Citation: Rapid7 HAFNIUM Mar 2021)
admin@338	admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: `dir c:\ >> %temp%\download` `dir "c:\Documents and Settings" >> %temp%\download` `dir "c:\Program Files\" >> %temp%\download` `dir d:\ >> %temp%\download`(Citation: FireEye admin@338)

Контрмера	Описание
Контрмеры
File and Directory Discovery Mitigation	File system activity is a common part of an operating system, so it is unlikely that mitigation would be appropriate for this technique. It may still be beneficial to identify and block unnecessary system utilities or potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. Further, Network Device CLI commands may also be used to gather file and directory information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Исследование файлов и каталогов

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги