NOOPLDRS9025 ↗
Can hide services used to aid execution.1
tfMITRE ATT&CK technique
Hide Artifacts T1564
- Tactic
- Stealth
- Platforms
- ESXi, Linux, macOS, Office Suite, Windows
- Version
- 2.0
- Created
- 26 February 2020
- Last modified
- 12 May 2026
Sub-techniques 1476 rules across the family · 12 mapped directly to T1564 · 6 of 14 carry rules
.001Hidden Files and Directories11.002Hidden Users4.003Hidden Window11.004NTFS File Attributes29.005Hidden File System0.006Run Virtual Instance4.007VBA Stomping0.008Email Hiding Rules7.009Resource Forking0.010Process Argument Spoofing0.011Ignore Process Interrupts0.012File/Path Exclusions0.013Bind Mounts0.014Extended Attributes0
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.[1][2][3]
ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact
0
Threat groupsNone recorded
Threat groupsNone recorded · 29% of ATT&CK techniques have none either.0
CampaignsNone recorded
CampaignsNone recorded · 54% of ATT&CK techniques have none either.7
Tools & malware71st pct
Tools & malware71st percentile · 69% of ATT&CK techniques have fewer tools implementing them.12
Detection rulesTop 21%
Detection rules79th percentile · 77% of ATT&CK techniques have fewer detection rules written.