Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.[1] Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).[2]
Some files and directories may require elevated or specific user permissions to access.
Threat groups98th percentile · 98% of ATT&CK techniques have fewer threat groups attributed.
13
CampaignsTop 2%
Campaigns98th percentile · 97% of ATT&CK techniques have fewer campaigns recorded.
308
Tools & malwareTop 1%
Tools & malware99th percentile · 99% of ATT&CK techniques have fewer tools implementing them.
29
Detection rulesTop 10%
Detection rules90th percentile · 90% of ATT&CK techniques have fewer detection rules written.
File and Directory Discovery MITRE reference T1083
Top 2%of all ATT&CK techniques for number of groups
52 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.
Has checked mount points for Oracle PeopleSoft configurations and has checked the process scheduler configuration file psappsrv.cfg. Additionally, ShinyHunters has read WebLogic server XML configurations files (config.xml).1
Has run commands to check the content of folders on compromised hosts and has specifically targeted files with .doc, .ppt, .xls, .jtd, .eml, .xps, and .pdf extensions.123
Has searched for files within the victim environment for encryption and exfiltration.123Medusa Group has also identified files associated with remote management services.12
During the Anthropic AI-orchestrated Campaign, the adversary leveraged Claude Code to identify sensitive data within the victim environment for extraction.1
Gathers a list of filenames from the following locations during execution of the final botnet stage: \/usr\/sbin\/, \/usr\/bin\/, \/sbin\/, \/pfrm2.0\/bin\/, \/usr\/local\/bin\/.1
2022–2024
All 13 campaigns for this technique · 6 newest in this preview
308 software entries are documented implementing this technique. MITRE files each as a tool or as malware; newest first, then by how many groups carry them.
File and Directory Discovery detection strategy DET0370
MITRE names one behaviour worth catching for this technique and breaks it into 5 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.
Recursive Enumeration of Files and Directories Across Privilege Contexts
Enterprise
5 platforms
AN1040 · Windows
Execution of file enumeration commands (e.g., 'dir', 'tree') from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CommandLineRegex
Allows tuning based on tools/scripts used for enumeration (e.g., tree, dir /s /b)
UserContext
Scoping for standard vs elevated or service accounts
TimeWindow
Defines burst activity over short periods (e.g., >50 directory queries in 30s)
AN1041 · Linux
Use of file enumeration commands (e.g., 'ls', 'find', 'locate') executed by suspicious users or scripts accessing broad file hierarchies or restricted directories.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
FilePathDepth
Max depth of recursive access to tune noise vs anomaly
UserContext
Helpful to exclude known scripts or automation accounts
AN1042 · macOS
Execution of file or directory discovery commands (e.g., 'ls', 'find') from terminal or script-based tooling, especially outside normal user workflows.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CLICommandPattern
Match on esxcli storage|filesystem commands
AccessSource
Limit alerting to non-vCenter or remote IPs
AN1044 · Network Devices
Execution of file discovery commands (e.g., 'dir', 'show flash', 'nvram:') from CLI interfaces, especially by unauthorized users or from abnormal source IPs.
Log sources
The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.
MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.
Field
What you tune
CommandWhitelist
Filter allowed commands by account or IP
SessionOrigin
Tunable to restrict detection to remote terminal or Telnet/SSH
Tests9Executorspowershell 4 · sh 3 · command_prompt 2Need elevation0 of 9Have prerequisites2Have cleanup5Platformswindows, linux, macos
#
Test
Platform
Executor
Elevation
Prereqs
Cleanup
Ref
01
File and Directory Discovery (cmd.exe)
windows
command_prompt
—
—
Yes
Find or discover files on the file system. Upon successful execution, this test will output the results of all the data discovery commands to a specified file.
Inputs
Name
Description
Type
Default Value
output_file
File to output results to
string
%temp%\T1083Test1.txt
Attack Commandsrun with command_prompt
dir /s c:\ >> #{output_file}
dir /s "c:\Documents and Settings" >> #{output_file}
dir /s "c:\Program Files\" >> #{output_file}
dir "%systemdrive%\Users\*.*" >> #{output_file}
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> #{output_file}
dir "%userprofile%\Desktop\*.*" >> #{output_file}
tree /F >> #{output_file}
Cleanup Commands
del #{output_file}
GUID0e36303b-6762-4500-b003-127743b80ba6
02
File and Directory Discovery (PowerShell)
windows
powershell
—
—
—
Find or discover files on the file system. Upon execution, file and folder information will be displayed.
Attack Commandsrun with powershell
ls -recurse
get-childitem -recurse
gci -recurse
GUID2158908e-b7ef-4c21-8a83-3ce4dd05a924
03
Nix File and Directory Discovery
linux, macos
sh
—
—
Yes
Find or discover files on the file system
References:
http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/
https://perishablepress.com/list-files-folders-recursively-terminal/
Inputs
Name
Description
Type
Default Value
output_file
Output file used to store the results.
path
/tmp/T1083.txt
Attack Commandsrun with sh
ls -a >> #{output_file}
if [ -d /Library/Preferences/ ]; then ls -la /Library/Preferences/ > #{output_file}; fi;
file */* *>> #{output_file}
cat #{output_file} 2>/dev/null
find . -type f
ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
locate *
which sh
Cleanup Commands
rm #{output_file}
GUIDffc8b249-372a-4b74-adcd-e4c0430842de
04
Nix File and Directory Discovery 2
linux, macos
sh
—
—
Yes
Find or discover files on the file system
Inputs
Name
Description
Type
Default Value
output_file
Output file used to store the results.
path
/tmp/T1083.txt
Attack Commandsrun with sh
cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > #{output_file}
if [ -f /etc/mtab ]; then cat /etc/mtab >> #{output_file}; fi;
find . -type f -iname *.pdf >> #{output_file}
cat #{output_file}
find . -type f -name ".*"
Cleanup Commands
rm #{output_file}
GUID13c5e1ae-605b-46c4-a79f-db28c77ff24e
05
Simulating MAZE Directory Enumeration
windows
powershell
—
—
Yes
This test emulates MAZE ransomware's ability to enumerate directories using Powershell.
Upon successful execution, this test will output the directory enumeration results to a specified file, as well as display them in the active window.
See https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents
Launches the DirLister executable for a short period of time and then exits.
Recently seen used by BlackCat ransomware to create a list of accessible directories and files.
If the system uses network file systems (e.g., NFS, CIFS), findmnt can help locate paths to remote shares.
Attackers may then attempt to access these shares for lateral movement or data exfiltration.
Attack Commandsrun with sh
findmnt -t nfs
GUID361fe49d-0c19-46ec-a483-ccb92d38e88e
09
Recursive Enumerate Files And Directories By Powershell
windows
powershell
—
—
Yes
Adversary attempting to discover and collect sensitive documents and archives
from a user’s system. The test recursively enumerates common user folders
(Documents, Downloads, Desktop, OneDrive) for file types of interest such as .pdf, .doc,
.docx, .xls, .xlsx, .txt, .zip, .rar, and .7z.
This behavior is similar to malware like LOSTKEYS used by COLDRIVER in January 2025,
where attackers perform targeted file discovery to support strategic intelligence collection https://www.zscaler.com/blogs/security-research/coldriver-updates-arsenal-baitswitch-and-simplefix.
The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. (...)
The following analytic detects suspicious file and directory discovery activities, which may indicate an attacker's effort to locate sensitive documents and files on a compromised system. (...)
The following analytic detects suspicious creation of hidden files and directories, which may indicate an attacker's attempt to conceal malicious activities or unauthorized data. (...)
The following analytic detects suspicious discovery of virtual disk files and directories, which may indicate an attacker's attempt to locate and access virtualized storage environments. (...)
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.