MITRE ATT&CK - Техника Исследование файлов и каталогов

Куда я попал?

SECURITM это SGRC система, автоматизирующая процессы в службах информационной безопасности. SECURITM помогает построить и управлять ИСПДн, КИИ, ГИС, СМИБ/СУИБ, банковскими системами защиты.
А еще SECURITM это место для обмена опытом и наработками для служб безопасности.

Подробнее

Наш канал

Исследование файлов и каталогов

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A)

ID: T1083

Тактика(-и): Discovery

Платформы: Linux, macOS, Network, Windows

Источники данных: Command: Command Execution, Process: OS API Execution, Process: Process Creation

Версия: 1.5

Дата создания: 31 May 2017

Последнее изменение: 06 Sep 2022

Название	Описание
Примеры процедур
BLACKCOFFEE	BLACKCOFFEE has the capability to enumerate files.(Citation: FireEye APT17)
Orz	Orz can gather victim drive information.(Citation: Proofpoint Leviathan Oct 2017)
Attor	Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.(Citation: ESET Attor Oct 2019)
USBStealer	USBStealer searches victim drives for files matching certain extensions (“.skr”,“.pkr” or “.key”) or names.(Citation: ESET Sednit USBStealer 2014)(Citation: Kaspersky Sofacy)
SDBbot	SDBbot has the ability to get directory listings or drive information on a compromised host.(Citation: Proofpoint TA505 October 2019)
Kinsing	Kinsing has used the find command to search for specific files.(Citation: Aqua Kinsing April 2020)
Amadey	Amadey has searched for folders associated with antivirus software.(Citation: Korean FSI TA505 2020)
Ebury	Ebury can list directory entries.(Citation: ESET Ebury Oct 2017)
PlugX	PlugX has a module to enumerate drives and find files recursively.(Citation: CIRCL PlugX March 2013)(Citation: Proofpoint TA416 Europe March 2022)
Volgmer	Volgmer can list directories on a victim.(Citation: US-CERT Volgmer Nov 2017)
P.A.S. Webshell	P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.(Citation: ANSSI Sandworm January 2021)
Bazar	Bazar can enumerate the victim's desktop.(Citation: Cybereason Bazar July 2020)(Citation: NCC Group Team9 June 2020)
Crimson	Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.(Citation: Proofpoint Operation Transparent Tribe March 2016)(Citation: Kaspersky Transparent Tribe August 2020)(Citation: Cisco Talos Transparent Tribe Education Campaign July 2022)
SynAck	SynAck checks its directory location in an attempt to avoid launching in a sandbox.(Citation: SecureList SynAck Doppelgänging May 2018)(Citation: Kaspersky Lab SynAck May 2018)
Patchwork	A Patchwork payload has searched all fixed drives on the victim for files matching a specified list of extensions.(Citation: Cymmetria Patchwork)(Citation: TrendMicro Patchwork Dec 2017)
Sowbug	Sowbug identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.(Citation: Symantec Sowbug Nov 2017)
yty	yty gathers information on victim’s drives and has a plugin for document listing.(Citation: ASERT Donot March 2018)
TAINTEDSCRIBE	TAINTEDSCRIBE can use `DirectoryList` to enumerate files in a specified directory.(Citation: CISA MAR-10288834-2.v1 TAINTEDSCRIBE MAY 2020)
ELMER	ELMER is capable of performing directory listings.(Citation: FireEye EPS Awakens Part 2)
SUGARDUMP	SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string `Profile` in its name.(Citation: Mandiant UNC3890 Aug 2022)
	During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.(Citation: DFIR Conti Bazar Nov 2021)
Fysbis	Fysbis has the ability to search for files.(Citation: Fysbis Dr Web Analysis)
Remsec	Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.(Citation: Symantec Remsec IOCs)(Citation: Kaspersky ProjectSauron Full Report)(Citation: Kaspersky ProjectSauron Technical Analysis)
KillDisk	KillDisk has used the `FindNextFile` command as part of its file deletion process.(Citation: Trend Micro KillDisk 2)
	During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.(Citation: McAfee Honeybee)
WinMM	WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.(Citation: Baumgartner Naikon 2015)
Gamaredon Group	Gamaredon Group macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. Gamaredon Group has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.(Citation: ESET Gamaredon June 2020)(Citation: Unit 42 Gamaredon February 2022)
Turian	Turian can search for specific files and list directories.(Citation: ESET BackdoorDiplomacy Jun 2021)
POORAIM	POORAIM can conduct file browsing.(Citation: FireEye APT37 Feb 2018)
Micropsia	Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.(Citation: Radware Micropsia July 2018)
Misdat	Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.(Citation: Cylance Dust Storm)
Winnti for Windows	Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.(Citation: Novetta Winnti April 2015)
GeminiDuke	GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.(Citation: F-Secure The Dukes)
BoxCaon	BoxCaon has searched for files on the system, such as documents located in the desktop folder.(Citation: Checkpoint IndigoZebra July 2021)
	During Operation CuckooBees, the threat actors used `dir c:\\` to search for files.(Citation: Cybereason OperationCuckooBees May 2022)
njRAT	njRAT can browse file systems using a file manager module.(Citation: Fidelis njRAT June 2013)
PinchDuke	PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.(Citation: F-Secure The Dukes)
WindTail	WindTail has the ability to enumerate the users home directory and the path to its own application bundle.(Citation: objective-see windtail1 dec 2018)(Citation: objective-see windtail2 jan 2019)
Dragonfly	Dragonfly has used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)(Citation: Gigamon Berserk Bear October 2021)(Citation: CISA AA20-296A Berserk Bear December 2020)
AuditCred	AuditCred can search through folders and files on the system.(Citation: TrendMicro Lazarus Nov 2018)
Diavol	Diavol has a command to traverse the files and directories in a given path.(Citation: Fortinet Diavol July 2021)
Sliver	Sliver can enumerate files on a target system.(Citation: GitHub Sliver File System August 2021)
PowerDuke	PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.(Citation: Volexity PowerDuke November 2016)
BackConfig	BackConfig has the ability to identify folders and files related to previous infections.(Citation: Unit 42 BackConfig May 2020)
Bankshot	Bankshot searches for files on the victim's machine.(Citation: US-CERT Bankshot Dec 2017)
PingPull	PingPull can enumerate storage volumes and folder contents of a compromised host.(Citation: Unit 42 PingPull Jun 2022)
4H RAT	4H RAT has the capability to obtain file and directory listings.(Citation: CrowdStrike Putter Panda)
FALLCHILL	FALLCHILL can search files on a victim.(Citation: US-CERT FALLCHILL Nov 2017)
MarkiRAT	MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.(Citation: Kaspersky Ferocious Kitten Jun 2021)
Epic	Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.(Citation: Kaspersky Turla)(Citation: Kaspersky Turla Aug 2014)
Clambling	Clambling can browse directories on a compromised host.(Citation: Trend Micro DRBControl February 2020)(Citation: Talent-Jump Clambling February 2020)
down_new	down_new has the ability to list the directories on a compromised host.(Citation: Trend Micro Tick November 2019)
Ryuk	Ryuk has enumerated files and folders on all mounted drives.(Citation: CrowdStrike Ryuk January 2019)
QakBot	QakBot can identify whether it has been run previously on a host by checking for a specified folder.(Citation: ATT QakBot April 2021)
PoetRAT	PoetRAT has the ability to list files upon receiving the `ls` command from C2.(Citation: Talos PoetRAT April 2020)
WhisperGate	WhisperGate can locate files based on hardcoded file extensions.(Citation: Microsoft WhisperGate January 2022)(Citation: Unit 42 WhisperGate January 2022)(Citation: Cisco Ukraine Wipers January 2022)(Citation: Medium S2W WhisperGate January 2022)
cmd	cmd can be used to find files and directories with native functionality such as `dir` commands.(Citation: TechNet Dir)
Seasalt	Seasalt has the capability to identify the drive type on a victim.(Citation: McAfee Oceansalt Oct 2018)
APT38	APT38 have enumerated files and directories, or searched in specific locations within a compromised host.(Citation: CISA AA20-239A BeagleBoyz August 2020)
APT28	APT28 has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.(Citation: Überwachung APT28 Forfiles June 2015)(Citation: DOJ GRU Indictment Jul 2018)
KEYMARBLE	KEYMARBLE has a command to search for files on the victim’s machine.(Citation: US-CERT KEYMARBLE Aug 2018)
Operation Wocao	Operation Wocao has gathered a recursive directory listing to find files and directories of interest.(Citation: FoxIT Wocao December 2019)
SHOTPUT	SHOTPUT has a command to obtain a directory listing.(Citation: Palo Alto CVE-2015-3113 July 2015)
WINERACK	WINERACK can enumerate files and directories.(Citation: FireEye APT37 Feb 2018)
Cardinal RAT	Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).(Citation: PaloAlto CardinalRat Apr 2017)
OwaAuth	OwaAuth has a command to list its directory and logical drives.(Citation: Dell TG-3390)
RARSTONE	RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.(Citation: Camba RARSTONE)
Kivars	Kivars has the ability to list drives on the infected host.(Citation: TrendMicro BlackTech June 2017)
BlackEnergy	BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.(Citation: F-Secure BlackEnergy 2014)(Citation: Securelist BlackEnergy Nov 2014)
WannaCry	WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.(Citation: LogRhythm WannaCry)(Citation: FireEye WannaCry 2017)
UNC2452	UNC2452 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.(Citation: Volexity SolarWinds)
SoreFang	SoreFang has the ability to list directories.(Citation: CISA SoreFang July 2016)
AutoIt backdoor	AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.(Citation: Forcepoint Monsoon)
Caterpillar WebShell	Caterpillar WebShell can search for files in directories.(Citation: ClearSky Lebanese Cedar Jan 2021)
APT29	APT29 obtained information about the configured Exchange virtual directory using `Get-WebServicesVirtualDirectory`.(Citation: Volexity SolarWinds)
Inception	Inception used a file listing plugin to collect information about file and directories both on local and remote drives.(Citation: Symantec Inception Framework March 2018)
USBferry	USBferry can detect the victim's file or folder list.(Citation: TrendMicro Tropic Trooper May 2020)
Avaddon	Avaddon has searched for specific files prior to encryption.(Citation: Arxiv Avaddon Feb 2021)
Rclone	Rclone can list files and directories with the `ls`, `lsd`, and `lsl` commands.(Citation: Rclone)
SideTwist	SideTwist has the ability to search for specific files.(Citation: Check Point APT34 April 2021)
GrimAgent	GrimAgent has the ability to enumerate files and directories on a compromised host.(Citation: Group IB GrimAgent July 2021)
Skidmap	Skidmap has checked for the existence of specific files including `/usr/sbin/setenforce` and `/etc/selinux/config`. It also has the ability to monitor the cryptocurrency miner file and process. (Citation: Trend Micro Skidmap)
zwShell	zwShell can browse the file system.(Citation: McAfee Night Dragon)
ZxShell	ZxShell has a command to open a file manager and explorer on the system.(Citation: Talos ZxShell Oct 2014)
DropBook	DropBook can collect the names of all files and folders in the Program Files directories.(Citation: Cybereason Molerats Dec 2020)(Citation: BleepingComputer Molerats Dec 2020)
TSCookie	TSCookie has the ability to discover drive information on the infected host.(Citation: JPCert TSCookie March 2018)
Kwampirs	Kwampirs collects a list of files and directories in C:\ with the command `dir /s /a c:\ >> "C:\windows\TEMP\[RANDOM].tmp"`.(Citation: Symantec Orangeworm April 2018)
JPIN	JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.(Citation: Microsoft PLATINUM April 2016)
ZLib	ZLib has the ability to enumerate files and drives.(Citation: Cylance Dust Storm)
FLASHFLOOD	FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.(Citation: FireEye APT30)
Lokibot	Lokibot can search for specific files on an infected host.(Citation: Talos Lokibot Jan 2021)
HOPLIGHT	HOPLIGHT has been observed enumerating system drives and partitions.(Citation: US-CERT HOPLIGHT Apr 2019)
Chimera	Chimera has utilized multiple commands to identify data of interest in file and directory listings.(Citation: NCC Group Chimera January 2021)
BadPatch	BadPatch searches for files with specific file extensions.(Citation: Unit 42 BadPatch Oct 2017)
NETEAGLE	NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.(Citation: FireEye APT30)
SysUpdate	SysUpdate can search files on a compromised host.(Citation: Trend Micro Iron Tiger April 2021)
BabyShark	BabyShark has used `dir` to search for "programfiles" and "appdata".(Citation: Unit42 BabyShark Feb 2019)
admin@338	admin@338 actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: `dir c:\ >> %temp%\download` `dir "c:\Documents and Settings" >> %temp%\download` `dir "c:\Program Files\" >> %temp%\download` `dir d:\ >> %temp%\download`(Citation: FireEye admin@338)
MoonWind	MoonWind has a command to return a directory listing for a specified directory.(Citation: Palo Alto MoonWind March 2017)
Ke3chang	Ke3chang uses command-line interaction to search files and directories.(Citation: Mandiant Operation Ke3chang November 2014)(Citation: Microsoft NICKEL December 2021)
MegaCortex	MegaCortex can parse the available drives and directories to determine which files to encrypt.(Citation: IBM MegaCortex)
Pteranodon	Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.(Citation: Palo Alto Gamaredon Feb 2017)
CookieMiner	CookieMiner has looked for files in the user's home directory with "wallet" in their name using `find`.(Citation: Unit42 CookieMiner Jan 2019)
CrossRAT	CrossRAT can list all files on a system.
DEATHRANSOM	DEATHRANSOM can use loop operations to enumerate directories on a compromised host.(Citation: FireEye FiveHands April 2021)
InnaputRAT	InnaputRAT enumerates directories and obtains file attributes on a system.(Citation: ASERT InnaputRAT April 2018)
SUNBURST	SUNBURST had commands to enumerate files and directories.(Citation: FireEye SUNBURST Backdoor December 2020)(Citation: Microsoft Analyzing Solorigate Dec 2020)
Cuba	Cuba can enumerate files by using a variety of functions.(Citation: McAfee Cuba April 2021)
Linfo	Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.(Citation: Symantec Linfo May 2012)
CosmicDuke	CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.(Citation: F-Secure Cosmicduke)
Sandworm Team	Sandworm Team has enumerated files on a compromised host.(Citation: US District Court Indictment GRU Unit 74455 October 2020)(Citation: Dragos Crashoverride 2018)
Kazuar	Kazuar finds a specified directory, lists the files and metadata about those files.(Citation: Unit 42 Kazuar May 2017)
XAgentOSX	XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory.(Citation: XAgentOSX 2017) XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running `ls -la ~/Library/Application\ Support/MobileSync/Backup/`.(Citation: XAgentOSX 2017)
HermeticWiper	HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.(Citation: SentinelOne Hermetic Wiper February 2022)(Citation: Qualys Hermetic Wiper March 2022)
Cyclops Blink	Cyclops Blink can use the Linux API `statvfs` to enumerate the current working directory.(Citation: NCSC Cyclops Blink February 2022)(Citation: Trend Micro Cyclops Blink March 2022)
FIVEHANDS	FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.(Citation: CISA AR21-126A FIVEHANDS May 2021)(Citation: NCC Group Fivehands June 2021)
Cobalt Strike	Cobalt Strike can explore files on a compromised system.(Citation: Cobalt Strike Manual 4.3 November 2020)
DarkWatchman	DarkWatchman has the ability to enumerate file and folder names.(Citation: Prevailion DarkWatchman 2021)
Industroyer	Industroyer’s data wiper component enumerates specific files on all the Windows drives.(Citation: ESET Industroyer)
Brave Prince	Brave Prince gathers file and directory information from the victim’s machine.(Citation: McAfee Gold Dragon)
OceanSalt	OceanSalt can extract drive information from the endpoint and search files on the system.(Citation: McAfee Oceansalt Oct 2018)
NETWIRE	NETWIRE has the ability to search for files on the compromised host.(Citation: Proofpoint NETWIRE December 2020)
Sidewinder	Sidewinder has used malware to collect information on files and directories.(Citation: ATT Sidewinder January 2021)
TINYTYPHON	TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.(Citation: Forcepoint Monsoon)
Octopus	Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.(Citation: Securelist Octopus Oct 2018)(Citation: Security Affairs DustSquad Oct 2018)(Citation: ESET Nomadic Octopus 2018)
SUNSPOT	SUNSPOT enumerated the Orion software Visual Studio solution directory path.(Citation: CrowdStrike SUNSPOT Implant January 2021)
Zox	Zox can enumerate files on a compromised host.(Citation: Novetta-Axiom)
Elise	A variant of Elise executes `dir C:\progra~1` when initially run.(Citation: Lotus Blossom Jun 2015)(Citation: Accenture Dragonfish Jan 2018)
Honeybee	Honeybee's service-based DLL implant traverses the FTP server’s directories looking for files with keyword matches for computer names or certain keywords.(Citation: McAfee Honeybee)
Bisonal	Bisonal can retrieve a file listing from the system.(Citation: Kaspersky CactusPete Aug 2020)(Citation: Talos Bisonal Mar 2020)
MiniDuke	MiniDuke can enumerate local drives.(Citation: ESET Dukes October 2019)
Conti	Conti can discover files on a local system.(Citation: CarbonBlack Conti July 2020)
SLOTHFULMEDIA	SLOTHFULMEDIA can enumerate files and directories.(Citation: CISA MAR SLOTHFULMEDIA October 2020)
ADVSTORESHELL	ADVSTORESHELL can list files and directories.(Citation: ESET Sednit Part 2)(Citation: Bitdefender APT28 Dec 2015)
FinFisher	FinFisher enumerates directories and scans for certain files.(Citation: FinFisher Citation)(Citation: Microsoft FinFisher March 2018)
Avenger	Avenger has the ability to browse files in directories such as Program Files and the Desktop.(Citation: Trend Micro Tick November 2019)
CharmPower	CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.(Citation: Check Point APT35 CharmPower January 2022)
REvil	REvil has the ability to identify specific files and directories that are not to be encrypted.(Citation: Kaspersky Sodin July 2019)(Citation: Cylance Sodinokibi July 2019)(Citation: Secureworks GandCrab and REvil September 2019)(Citation: McAfee Sodinokibi October 2019)(Citation: Intel 471 REvil March 2020)(Citation: Secureworks REvil September 2019)
Empire	Empire includes various modules for finding files of interest on hosts and network shares.(Citation: Github PowerShell Empire)
Pupy	Pupy can walk through directories and recursively search for strings in files.(Citation: GitHub Pupy)
Gelsemium	Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.(Citation: ESET Gelsemium June 2021)
Aoqin Dragon	Aoqin Dragon has run scripts to identify file formats including Microsoft Word.(Citation: SentinelOne Aoqin Dragon June 2022)
Proxysvc	Proxysvc lists files in directories.(Citation: McAfee GhostSecret)
Tropic Trooper	Tropic Trooper has monitored files' modified time.(Citation: TrendMicro Tropic Trooper May 2020)
Dark Caracal	Dark Caracal collected file listings of all default Windows directories.(Citation: Lookout Dark Caracal Jan 2018)
GravityRAT	GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.(Citation: Talos GravityRAT)
Bandook	Bandook has a command to list files on a system.(Citation: CheckPoint Bandook Nov 2020)
MuddyWater	MuddyWater has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."(Citation: Securelist MuddyWater Oct 2018)
Trojan.Karagany	Trojan.Karagany can enumerate files and directories on a compromised host.(Citation: Secureworks Karagany July 2019)
PoshC2	PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.(Citation: GitHub PoshC2)
3PARA RAT	3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.(Citation: CrowdStrike Putter Panda)
NotPetya	NotPetya searches for files ending with dozens of different file extensions prior to encryption.(Citation: US District Court Indictment GRU Unit 74455 October 2020)
ThreatNeedle	ThreatNeedle can obtain file and directory information.(Citation: Kaspersky ThreatNeedle Feb 2021)
BoomBox	BoomBox can search for specific files and directories on a machine.(Citation: MSTIC Nobelium Toolset May 2021)
jRAT	jRAT can browse file systems.(Citation: Kaspersky Adwind Feb 2016)(Citation: Symantec Frutas Feb 2013)
Clop	Clop has searched folders and subfolders for files to encrypt.(Citation: Mcafee Clop Aug 2019)
GoldenSpy	GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.(Citation: Trustwave GoldenSpy June 2020)
OutSteel	OutSteel can search for specific file extensions, including zipped files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
FYAnti	FYAnti can search the `C:\Windows\Microsoft.NET\` directory for files of a specified size.(Citation: Securelist APT10 March 2021)
BADFLICK	BADFLICK has searched for files on the infected host.(Citation: Accenture MUDCARP March 2019)
CaddyWiper	CaddyWiper can enumerate all files and directories on a compromised host.(Citation: Malwarebytes IssacWiper CaddyWiper March 2022 )
Dragonfly 2.0	Dragonfly 2.0 used a batch script to gather folder and file names from victim hosts.(Citation: US-CERT TA18-074A)
Stuxnet	Stuxnet uses a driver to scan for specific filesystem driver objects.(Citation: Symantec W.32 Stuxnet Dossier)
CHOPSTICK	An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.(Citation: ESET Sednit Part 2)
Zebrocy	Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the `echo %APPDATA%` command to list the contents of the directory.(Citation: Securelist Sofacy Feb 2018)(Citation: ESET Zebrocy Nov 2018)(Citation: ESET Zebrocy May 2019) Zebrocy can obtain the current execution path as well as perform drive enumeration.(Citation: Accenture SNAKEMACKEREL Nov 2018)(Citation: CISA Zebrocy Oct 2020)
Magic Hound	Magic Hound malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.(Citation: Unit 42 Magic Hound Feb 2017)
PLEAD	PLEAD has the ability to list drives and files on the compromised host.(Citation: TrendMicro BlackTech June 2017)(Citation: JPCert PLEAD Downloader June 2018)
Okrum	Okrum has used DriveLetterView to enumerate drive information.(Citation: ESET Okrum July 2019)
ObliqueRAT	ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.(Citation: Talos Oblique RAT March 2021)
BBSRAT	BBSRAT can list file and directory information.(Citation: Palo Alto Networks BBSRAT)
StrongPity	StrongPity can parse the hard drive on a compromised host to identify specific file extensions.(Citation: Talos Promethium June 2020)
QuietSieve	QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.(Citation: Microsoft Actinium February 2022)
ROKRAT	ROKRAT has the ability to gather a list of files and directories on the infected system.(Citation: Securelist ScarCruft May 2019)(Citation: NCCGroup RokRat Nov 2018)(Citation: Volexity InkySquid RokRAT August 2021)
TeamTNT	TeamTNT has used a script that checks `/proc/*/environ` for environment variables related to AWS.(Citation: Cisco Talos Intelligence Group)
HotCroissant	HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.(Citation: Carbon Black HotCroissant April 2020)
Peppy	Peppy can identify specific files for exfiltration.(Citation: Proofpoint Operation Transparent Tribe March 2016)
Psylo	Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.(Citation: Scarlet Mimic Jan 2016)
Doki	Doki has resolved the path of a process PID to use as a script argument.(Citation: Intezer Doki July 20)
Koadic	Koadic can obtain a list of directories.(Citation: MalwareBytes LazyScripter Feb 2021)
BlackMould	BlackMould has the ability to find files on the targeted system.(Citation: Microsoft GALLIUM December 2019)
CreepyDrive	CreepyDrive can specify the local file path to upload files from.(Citation: Microsoft POLONIUM June 2022)
	During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.(Citation: FoxIT Wocao December 2019)
POWRUNER	POWRUNER may enumerate user directories on a victim.(Citation: FireEye APT34 Dec 2017)
KeyBoy	KeyBoy has a command to launch a file browser or explorer on the system.(Citation: PWC KeyBoys Feb 2017)
Dtrack	Dtrack can list files on available disk volumes.(Citation: Securelist Dtrack)(Citation: CyberBit Dtrack)
BACKSPACE	BACKSPACE allows adversaries to search for files.(Citation: FireEye APT30)
DDKONG	DDKONG lists files on the victim’s machine.(Citation: Rancor Unit42 June 2018)
Denis	Denis has several commands to search directories for files.(Citation: Cybereason Oceanlotus May 2017)(Citation: Cybereason Cobalt Kitty 2017)
OSX/Shlayer	OSX/Shlayer has used the command `appDir="$(dirname $(dirname "$currentDir"))"` and `$(dirname "$(pwd -P)")` to construct installation paths.(Citation: sentinelone shlayer to zshlayer)(Citation: 20 macOS Common Tools and Techniques)
Heyoka Backdoor	Heyoka Backdoor has the ability to search the compromised host for files.(Citation: SentinelOne Aoqin Dragon June 2022)
Forfiles	Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)(Citation: Überwachung APT28 Forfiles June 2015)
Cryptoistic	Cryptoistic can scan a directory to identify files for deletion.(Citation: SentinelOne Lazarus macOS July 2020)
CORALDECK	CORALDECK searches for specified files.(Citation: FireEye APT37 Feb 2018)
HTTPBrowser	HTTPBrowser is capable of listing files, folders, and drives on a victim.(Citation: Dell TG-3390)(Citation: ZScaler Hacking Team)
ChChes	ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.(Citation: FireEye APT10 April 2017)
APT3	APT3 has a tool that looks for files and directories on the local file system.(Citation: FireEye Clandestine Fox)(Citation: evolution of pirpi)
APT32	APT32's backdoor possesses the capability to list files and directories on a machine. (Citation: ESET OceanLotus Mar 2019)
Mustang Panda	Mustang Panda has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.(Citation: Avira Mustang Panda January 2020)
Pasam	Pasam creates a backdoor through which remote attackers can retrieve lists of files.(Citation: Symantec Pasam May 2012)
RainyDay	RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.(Citation: Bitdefender Naikon April 2021)
InvisiMole	InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.(Citation: ESET InvisiMole June 2018)
Dust Storm	Dust Storm has used Android backdoors capable of enumerating specific files on the infected devices.(Citation: Cylance Dust Storm)
	During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.(Citation: McAfee Night Dragon)
Gold Dragon	Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.(Citation: McAfee Gold Dragon)
AppleSeed	AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.(Citation: Malwarebytes Kimsuky June 2021)
CrackMapExec	CrackMapExec can discover specified filetypes and log files on a targeted system.(Citation: CME Github September 2018)
FoggyWeb	FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.(Citation: MSTIC FoggyWeb September 2021)
Cannon	Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.(Citation: Unit42 Cannon Nov 2018)
KGH_SPY	KGH_SPY can enumerate files and directories on a compromised host.(Citation: Cybereason Kimsuky November 2020)
WastedLocker	WastedLocker can enumerate files and directories just prior to encryption.(Citation: NCC Group WastedLocker June 2020)
NDiskMonitor	NDiskMonitor can obtain a list of all files and directories as well as logical drives.(Citation: TrendMicro Patchwork Dec 2017)
Ixeshe	Ixeshe can list file and directory information.(Citation: Trend Micro IXESHE 2012)
Backdoor.Oldrea	Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.(Citation: Symantec Dragonfly)
Derusbi	Derusbi is capable of obtaining directory, file, and drive listings.(Citation: Fidelis Turbo)(Citation: FireEye Periscope March 2018)
Siloscape	Siloscape searches for the Kubernetes config file and other related files using a regular expression.(Citation: Unit 42 Siloscape Jun 2021)
APT39	APT39 has used tools with the ability to search for files on a compromised host.(Citation: FBI FLASH APT39 September 2020)
StrifeWater	StrifeWater can enumerate files on a compromised host.(Citation: Cybereason StrifeWater Feb 2022)
MobileOrder	MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.(Citation: Scarlet Mimic Jan 2016)
BLUELIGHT	BLUELIGHT can enumerate files and collect associated metadata.(Citation: Volexity InkySquid BLUELIGHT August 2021)
ccf32	ccf32 can parse collected files to identify specific file extensions.(Citation: Bitdefender FunnyDream Campaign November 2020)
Lazarus Group	Several Lazarus Group has conducted word searches on compromised machines to identify specific documents of interest. Lazarus Group malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.(Citation: Novetta Blockbuster)(Citation: McAfee GhostSecret)(Citation: ClearSky Lazarus Aug 2020)(Citation: Lazarus APT January 2022)(Citation: Qualys LolZarus)
SILENTTRINITY	SILENTTRINITY has several modules, such as `ls.py`, `pwd.py`, and `recentFiles.py`, to enumerate directories and files.(Citation: GitHub SILENTTRINITY Modules July 2019)
Darkhotel	Darkhotel has used malware that searched for files with specific patterns.(Citation: Microsoft DUBNIUM July 2016)
TajMahal	TajMahal has the ability to index files from drives, user profiles, and removable drives.(Citation: Kaspersky TajMahal April 2019)
SOUNDBITE	SOUNDBITE is capable of enumerating and manipulating files and directories.(Citation: FireEye APT32 May 2017)
RemoteUtilities	RemoteUtilities can enumerate files and directories on a target machine.(Citation: Trend Micro Muddy Water March 2021)
Hydraq	Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.(Citation: Symantec Trojan.Hydraq Jan 2010)(Citation: Symantec Hydraq Jan 2010)
StreamEx	StreamEx has the ability to enumerate drive types.(Citation: Cylance Shell Crew Feb 2017)
Taidoor	Taidoor can search for specific files.(Citation: CISA MAR-10292089-1.v2 TAIDOOR August 2021)
menuPass	menuPass has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.(Citation: Symantec Cicada November 2020)
BLINDINGCAN	BLINDINGCAN can search, read, write, move, and execute files.(Citation: US-CERT BLINDINGCAN Aug 2020)(Citation: NHS UK BLINDINGCAN Aug 2020)
TrickBot	TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.(Citation: S2 Grupo TrickBot June 2017)(Citation: Trend Micro Trickbot Nov 2018)
Remcos	Remcos can search for files on the infected machine.(Citation: Riskiq Remcos Jan 2018)
LookBack	LookBack can retrieve file listings from the victim machine.(Citation: Proofpoint LookBack Malware Aug 2019)
Aria-body	Aria-body has the ability to gather metadata from a file and to search for file and directory names.(Citation: CheckPoint Naikon May 2020)
Kasidet	Kasidet has the ability to search for a given filename on a victim.(Citation: Zscaler Kasidet)
Kimsuky	Kimsuky has the ability to enumerate all files and directories on an infected system.(Citation: Securelist Kimsuky Sept 2013)(Citation: Talos Kimsuky Nov 2021)(Citation: KISA Operation Muzabi)
Ramsay	Ramsay can collect directory and file lists.(Citation: Eset Ramsay May 2020)(Citation: Antiy CERT Ramsay April 2020)
IceApple	The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.(Citation: CrowdStrike IceApple May 2022)
Action RAT	Action RAT has the ability to collect drive and file information on an infected machine.(Citation: MalwareBytes SideCopy Dec 2021)
Rising Sun	Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.(Citation: McAfee Sharpshooter December 2018)
SPACESHIP	SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.(Citation: FireEye APT30)
Penquin	Penquin can use the command code `do_vslist` to send file names, size, and status to C2.(Citation: Leonardo Turla Penquin May 2020)
Machete	Machete produces file listings in order to search for files to be exfiltrated.(Citation: ESET Machete July 2019)(Citation: Cylance Machete Mar 2017)(Citation: 360 Machete Sep 2020)
RTM	RTM can check for specific files and directories associated with virtualization and malware analysis.(Citation: Unit42 Redaman January 2019)
KONNI	A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.(Citation: Talos Konni May 2017)
RedLeaves	RedLeaves can enumerate and search for files and directories.(Citation: PWC Cloud Hopper Technical Annex April 2017)(Citation: FireEye APT10 April 2017)
Confucius	Confucius has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.(Citation: TrendMicro Confucius APT Aug 2021)
WarzoneRAT	WarzoneRAT can enumerate directories on a compromise host.(Citation: Check Point Warzone Feb 2020)
APT41	APT41 has executed `file /bin/pwd` on exploited victims, perhaps to return architecture related information.(Citation: FireEye APT41 March 2020)
Winnti Group	Winnti Group has used a program named ff.exe to search for specific documents on compromised hosts.(Citation: Kaspersky Winnti April 2013)
Saint Bot	Saint Bot can search a compromised host for specific files.(Citation: Palo Alto Unit 42 OutSteel SaintBot February 2022 )
Nebulae	Nebulae can list files and directories on a compromised host.(Citation: Bitdefender Naikon April 2021)
FruitFly	FruitFly looks for specific files and file types.(Citation: objsee mac malware 2017)
XCSSET	XCSSET has used `mdfind` to enumerate a list of apps known to grant screen sharing permissions.(Citation: Application Bundle Manipulation Brandon Dalton)
Azorult	Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.(Citation: Unit42 Azorult Nov 2018)
Remexi	Remexi searches for files on the system. (Citation: Securelist Remexi Jan 2019)
Windigo	Windigo has used a script to check for the presence of files created by OpenSSH backdoors.(Citation: ESET ForSSHe December 2018)
SombRAT	SombRAT can execute `enum` to enumerate files in storage on a compromised system.(Citation: BlackBerry CostaRicto November 2020)
APT18	APT18 can list files information for specific directories.(Citation: PaloAlto DNS Requests May 2016)
Prikormka	A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.(Citation: ESET Operation Groundbait)
Dacls	Dacls can scan directories on a compromised host.(Citation: TrendMicro macOS Dacls May 2020)
Imminent Monitor	Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.(Citation: QiAnXin APT-C-36 Feb2019)
Zeus Panda	Zeus Panda searches for specific directories on the victim’s machine.(Citation: GDATA Zeus Panda June 2017)
Rover	Rover automatically searches for files on local drives based on a predefined list of file extensions.(Citation: Palo Alto Rover)
FatDuke	FatDuke can enumerate directories on target machines.(Citation: ESET Dukes October 2019)
ShimRat	ShimRat can list directories.(Citation: FOX-IT May 2016 Mofang)
Pisloader	Pisloader has commands to list drives on the victim machine and to list file information for a given directory.(Citation: Palo Alto DNS Requests)
Fox Kitten	Fox Kitten has used WizTree to obtain network files and directory listings.(Citation: CISA AA20-259A Iran-Based Actor September 2020)
MacMa	MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.(Citation: ESET DazzleSpy Jan 2022)
Metamorfo	Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.(Citation: Medium Metamorfo Apr 2020)(Citation: Fortinet Metamorfo Feb 2020)(Citation: FireEye Metamorfo Apr 2018)
Smoke Loader	Smoke Loader recursively searches through directories for files.(Citation: Talos Smoke Loader July 2018)
UPPERCUT	UPPERCUT has the capability to gather the victim's current directory.(Citation: FireEye APT10 Sept 2018)
BADNEWS	BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.(Citation: TrendMicro Patchwork Dec 2017)
Leafminer	Leafminer used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.(Citation: Symantec Leafminer July 2018)
DustySky	DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.(Citation: DustySky)(Citation: Kaspersky MoleRATs April 2019)
MESSAGETAP	MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.(Citation: FireEye MESSAGETAP October 2019)
Turla	Turla surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent.(Citation: Kaspersky Turla)(Citation: ESET ComRAT May 2020) Turla RPC backdoors have also searched for files matching the `lPH*.dll` pattern.(Citation: ESET Turla PowerShell May 2019)
Babuk	Babuk has the ability to enumerate files on a targeted system.(Citation: McAfee Babuk February 2021)(Citation: Trend Micro Ransomware February 2021)
China Chopper	China Chopper's server component can list directory contents.(Citation: FireEye Periscope March 2018)
FunnyDream	FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.(Citation: Bitdefender FunnyDream Campaign November 2020)
BRONZE BUTLER	BRONZE BUTLER has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.(Citation: Secureworks BRONZE BUTLER Oct 2017)
TYPEFRAME	TYPEFRAME can search directories for files on the victim’s machine.(Citation: US-CERT TYPEFRAME June 2018)

Контрмера	Описание
Контрмеры
File and Directory Discovery Mitigation	File system activity is a common part of an operating system, so it is unlikely that mitigation would be appropriate for this technique. It may still be beneficial to identify and block unnecessary system utilities or potentially malicious software by using whitelisting (Citation: Beechey 2010) tools, like AppLocker, (Citation: Windows Commands JPCERT) (Citation: NSA MS AppLocker) or Software Restriction Policies (Citation: Corio 2008) where appropriate. (Citation: TechNet Applocker vs SRP)

Обнаружение

System and network discovery techniques normally occur throughout an operation as an adversary learns the environment. Data and events should not be viewed in isolation, but as part of a chain of behavior that could lead to other activities, such as Collection and Exfiltration, based on the information obtained. Monitor processes and command-line arguments for actions that could be taken to gather system and network information. Remote access tools with built-in features may interact directly with the Windows API to gather information. Information may also be acquired through Windows system management tools such as Windows Management Instrumentation and PowerShell. Further, Network Device CLI commands may also be used to gather file and directory information with built-in features native to the network device platform. Monitor CLI activity for unexpected or unauthorized use of commands being run by non-standard users from non-standard locations.

Ссылки

Связанные риски

Ничего не найдено

Каталоги

Мы используем cookie-файлы, чтобы получить статистику, которая помогает нам улучшить сервис для вас с целью персонализации сервисов и предложений. Вы может прочитать подробнее о cookie-файлах или изменить настройки браузера. Продолжая пользоваться сайтом, вы даёте согласие на использование ваших cookie-файлов и соглашаетесь с Политикой обработки персональных данных.

Исследование файлов и каталогов

Примеры процедур

Контрмеры

Обнаружение

Ссылки

Связанные риски

Каталоги