T1564 Hide Artifacts — ATT&CK Technique
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection. Adversaries may also attempt to hide artifacts associated with malicious behavior by creating computing regions that are isolated from common security instrumentation, such as through the use of virtualization technology.
Detection coverage (12)
- Mount Execution With Hidepid Parameter medium
- PUA - Process Hacker Execution medium
- PUA - System Informer Execution medium
- Suspicious Creation with Colorcpl high
- Suspicious Executable File Creation high
- Potentially Suspicious Execution From Parent Process In Public Folder high
- Virtualbox Driver Installation or Starting of VMs low
- CrashControl CrashDump Disabled medium
- Sysmon Configuration Modification high
- Sysmon Configuration Error high
- Windows New Deny Permission Set On Service SD Via Sc.EXE
- Windows New Service Security Descriptor Set Via Sc.EXE