Hidden Files and Directories T1564.001

Creates a hidden file inside a hidden directory

mkdir /var/tmp/.hidden-directory
echo "T1564.001" > /var/tmp/.hidden-directory/.hidden-file

rm -rf /var/tmp/.hidden-directory/

Hide a file on MacOS

xattr -lr * / 2>&1 /dev/null | grep -C 2 "00 00 00 00 00 00 00 00 40 00 FF FF FF FF 00 00"

Creates a file and marks it as a system file using the attrib.exe utility. Upon execution, open the file in file explorer then open Properties > Details and observe that the Attributes are "SA" for System and Archive.

attrib.exe +s #{file_to_modify}

del /A:S #{file_to_modify} >nul 2>&1

IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

echo system_Attrib_T1564.001 >> #{file_to_modify}

Creates a file and marks it as hidden using the attrib.exe utility.Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file and observe that the Attributes are "SH" for System and Hidden.

attrib.exe +h #{file_to_modify}

del /A:H #{file_to_modify} >nul 2>&1

IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

echo system_Attrib_T1564.001 >> #{file_to_modify}

Requires Apple Dev Tools

setfile -a V #{filename}

Hide a directory on MacOS

touch /var/tmp/T1564.001_mac.txt
chflags hidden /var/tmp/T1564.001_mac.txt

rm /var/tmp/T1564.001_mac.txt

Show all hidden files on MacOS

defaults write com.apple.finder AppleShowAllFiles YES

defaults write com.apple.finder AppleShowAllFiles NO

Disable Show Hidden files switch in registry. This technique was abused by several malware to hide their files from normal user. See how this trojan abuses this technique - https://www.sophos.com/en-us/threat-center/threat-analyses/viruses-and-spyware/W32~Tiotua-P/detailed-analysis.aspx

reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v ShowSuperHidden /t REG_DWORD /d 0 /f
reg add HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f

reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v ShowSuperHidden /f >nul 2>&1
reg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced" /v Hidden /f >nul 2>&1

Creates a file and marks it as hidden through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file and observe that the Attributes is "H" Hidden.

$file = Get-Item $env:temp\T1564.001-9.txt -Force
$file.attributes='Hidden'

cmd /c 'del /A:H #{file_to_modify} >nul 2>&1'

IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

echo system_Attrib_T1564.001-9 >> #{file_to_modify}

Creates a file and marks it as System through powershell. Upon execution, open File Epxplorer and enable View > Hidden Items. Then, open Properties > Details on the file and observe that the Attributes is "S" System.

$file = Get-Item $env:temp\T1564.001-10.txt -Force
$file.attributes='System'

cmd /c 'del /A:H #{file_to_modify} >nul 2>&1'

IF EXIST #{file_to_modify} ( EXIT 0 ) ELSE ( EXIT 1 )

echo system_Attrib_T1564.001-10 >> #{file_to_modify}