Techniques › T1083
T1083 File and Directory Discovery
discovery — ESXi, Linux, macOS, Network Devices, Windows · attack.mitre.org · JSON
1
MITRE detection strategy
5
analytics
24
Sigma rules tagged attack.t1083
5
KEV CVEs mapped here
<p>Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.</p><p>Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).</p><p>Some files and directories may require elevated or specific user permissions to access.</p>
KEV CVEs mapped to this technique · CTID Mappings Explorer
| CVE | Vendor / product | Mapping type | State | Added |
|---|---|---|---|---|
| CVE-2017-12637 | SAP NetWeaver | primary impact | Mapped | 2025-03-19 |
| CVE-2024-53704 | SonicWall SonicOS | primary impact | Mapped | 2025-02-18 |
| CVE-2023-22952 | SugarCRM Multiple Products | secondary impact | Stale | 2023-02-02 |
| CVE-2019-19781 | Citrix Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP Appliance | secondary impact | Mapped | 2021-11-03 |
| CVE-2019-11510 | Ivanti Pulse Connect Secure | secondary impact | Mapped | 2021-11-03 |
Detection strategy · ATT&CK Enterprise v19.2
- DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts v1.0
AN1040 WindowsExecution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.Tunable:
CommandLineRegexUserContextTimeWindowAN1041 LinuxUse of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.Tunable:FilePathDepthUserContextAN1042 macOSExecution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.Tunable:PredicateScopeTimeWindowAN1043 ESXiExecution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users.Tunable:CLICommandPatternAccessSourceAN1044 Network DevicesExecution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.Tunable:CommandWhitelistSessionOrigin
Sigma rules · SigmaHQ da9bb07d64, tag attack.t1083
Author: Daniil Yugoslavskiy, oscd.community
· 2020-10-19 (modified 2022-11-25) · logsource: product=macos category=process_creation · 089dbdf6-b960-4bcc-90e3-ffc3480c20f6
Detects usage of system utilities to discover files and directories
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 093d68c7-762a-42f4-9f46-95e79142571a
Detects the use of the "nice" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: frack113
· 2022-03-17 · logsource: product=windows category=ps_script · 162e69a7-7981-4344-84a9-0f1c9a217a52
Detects technique used by MAZE ransomware to enumerate directories using Powershell
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-10-18 (modified 2023-02-04) · logsource: product=windows category=process_creation · 38646daa-e78f-4ace-9de0-55547b2d30da
Detects the execution of the PUA/Recon tool Seatbelt via PE information of command line parameters
Author: The DFIR Report
· 2025-02-21 · logsource: product=windows category=process_creation · 3b4e950b-a3ea-44d3-877e-432071990709
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
Author: Florian Roth (Nextron Systems), Tom U. @c_APT_ure (collection), oscd.community, Jonhnathan Ribeiro
· 2019-01-16 (modified 2025-10-18) · logsource: product=windows category=process_creation · 41d40bff-377a-43e2-8e1b-2e543069e079
Detects WannaCry ransomware activity
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=windows category=process_creation · 44030449-b0df-4c94-aae1-502359ab28ee
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 4b09c71e-4269-4111-9cdd-107d8867f0cc
Detects the use of the "flock" command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 6adfbf8f-52be-4444-9bac-81b539624146
Detects the use of the find command to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or exploitation attempt.
Author: Nasreddine Bencherchali (Nextron Systems), Luc Génaux
· 2022-12-28 (modified 2026-06-05) · logsource: product=linux category=process_creation · 7ab8f73a-fcff-428b-84aa-6a5ff7877dea
Detects the use of "vim" and it's siblings commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: frack113
· 2022-09-16 · logsource: product=windows category=ps_script · 7d416556-6502-45b2-9bad-9d2f05f38997
Detect adversaries enumerate sensitive files
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-28 · logsource: product=linux category=process_creation · 8344c0e5-5783-47cc-9cf9-a0f7fd03e6cf
Detects usage of "find" binary in a suspicious manner to perform discovery
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-28 · logsource: product=macos category=process_creation · 85de3a19-b675-4a51-bfc6-b11a5186c971
Detects usage of "find" binary in a suspicious manner to perform discovery
Author: James Ahearn
· 2019-06-08 (modified 2022-10-05) · logsource: category=webserver · 953d460b-f810-420a-97a2-cfca4c98e602
Detects source code enumeration that use GET requests by keyword searches in URL strings
Author: Austin Clark
· 2019-08-12 (modified 2023-01-04) · logsource: product=cisco service=aaa · 9705a6a1-6db6-4a16-a987-15b7151e299b
Find information about network devices that is not stored in config files
Author: Li Ling, Andy Parkidomo, Robert Rakowski, Blake Hartstein (Bloomberg L.P.)
· 2024-09-02 · logsource: product=linux category=process_creation · 9b5de532-a757-4d70-946c-1f3e44f48b4d
Detects the use of the "gcc" utility to execute a shell. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: frack113
· 2022-08-20 (modified 2023-02-04) · logsource: product=windows category=process_creation · b4dc61f5-6cce-468e-a608-b48b469feaa2
Detect the usage of "DirLister.exe" a utility for quickly listing folder or drive contents. It was seen used by BlackCat ransomware to create a list of accessible directories and files.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-28 (modified 2024-09-02) · logsource: product=linux category=process_creation · bb382fd5-b454-47ea-a264-1828e4c766d6
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Author: Markus Neis
· 2017-11-07 (modified 2022-10-09) · logsource: product=windows category=process_creation · c601f20d-570a-4cde-a7d6-e17f99cb8e7f
Detects automated lateral movement by Turla group
Author: Daniil Yugoslavskiy, oscd.community, CheraghiMilad
· 2020-10-19 (modified 2024-12-01) · logsource: product=linux category=process_creation · d3feb4ee-ff1d-4d3d-bd10-5b28a238cc72
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Author: Swachchhanda Shrawan Poudel (Nextron Systems)
· 2025-09-24 · logsource: product=linux category=process_creation · d7a650c4-226c-451e-948f-cc490db506aa
Detects execution of TruffleHog, a tool used to search for secrets in different platforms like Git, Jira, Slack, SharePoint, etc. that could be used maliciously.
While it is a legitimate tool, intended for use in CI pipelines and security assessments,
It was observed in the Shai-Hulud malware campaign targeting npm packages to steal sensitive information.
Author: Nasreddine Bencherchali (Nextron Systems)
· 2022-12-28 (modified 2026-01-24) · logsource: product=linux category=process_creation · d8d97d51-122d-4cdd-9e2f-01b4b4933530
Detects usage of "getcap" binary. This is often used during recon activity to determine potential binaries that can be abused as GTFOBins or other.
Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali
· 2022-10-10 (modified 2024-11-23) · logsource: product=windows category=process_creation · fca949cc-79ca-446e-8064-01aa7e52ece5
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Author: Pawel Mazur
· 2021-11-28 (modified 2022-12-25) · logsource: product=linux service=auditd · fe10751f-1995-40a5-aaa2-c97ccb4123fe
Detects attempts to discover the files with setuid/setgid capability on them. That would allow adversary to escalate their privileges.