tfMITRE ATT&CK sub-technique

Hidden File System T1564.005

Tactic: Stealth
Platforms: Linux, macOS, Windows
Version: 2.0
Created: 28 June 2020
Last modified: 12 May 2026

Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage. Typically, a user engages with a file system through applications that allow them to access files and directories, which are an abstraction from their physical location (ex: disk sector). Standard file systems include FAT, NTFS, ext4, and APFS. File systems can also contain other structures, such as the Volume Boot Record (VBR) and Master File Table (MFT) in NTFS.[1]

ReconResource DevInitial AccessExecutionPersistencePriv EscStealthDef ImpairmentCred AccessDiscoveryLateral MoveCollectionC2ExfiltrationImpact

Threat groups56th pct

Threat groups56th percentile · 56% of ATT&CK techniques have this many threat groups attributed or fewer.

CampaignsNone recorded

CampaignsNone recorded · 54% of ATT&CK techniques have none either.

Tools & malware62nd pct

Tools & malware62nd percentile · 62% of ATT&CK techniques have this many tools implementing them or fewer.

Detection rulesNone recorded

Detection rulesNone recorded · 33% of ATT&CK techniques have none either.

Hidden File System MITRE reference T1564.005

56th pctamong all ATT&CK techniques for number of groups

2 groups have been recorded using this technique. Newest first; each entry carries MITRE’s procedure text and a link to the group’s full record. Click a name to filter the rules below.

StriderG0041 ↗

Has used a hidden file system that is stored as a file on disk.1

created 2017-05-311 referenceaka ProjectSauron

EquationG0020 ↗

Has used an encrypted virtual file system stored in the Windows Registry.1

created 2017-05-311 reference

All 2 groups for this technique

Offense vs defense T1564.005

Is defensive coverage keeping up with adversary use? Eight counts, each ranked against all 697 ATT&CK techniques. Attack sits left, defense right, so a shape leaning left means adversaries are better documented here than defenders are equipped. Hover any spoke for its percentile and the share of techniques that have more. The timeline below shows when each side arrived.

Hidden File System detection strategy DET0461

MITRE names one behaviour worth catching for this technique and breaks it into 3 analytics, one per platform. Each carries the log sources it needs and the fields you tune per environment.

Detection Strategy for Hidden File System Abuse

Enterprise

3 platforms

AN1271 · Windows

Anomalous creation or mounting of hidden partitions or virtual file systems. Defender view: detection of registry modifications linked to non-standard file systems, suspicious disk I/O patterns, or bootkit-like behavior where hidden volumes are accessed outside normal file system APIs.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Firmware ModificationDC0004	etw:Microsoft-Windows-Kernel-Storage	Raw disk I/O operations bypassing NTFS APIs
File ModificationDC0061	WinEventLog:Security	EventCode=4663, 4670, 4656
Windows Registry Key ModificationDC0063	WinEventLog:Sysmon	EventCode=13, 14

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredRegistryKeys	Specify registry paths for mount points and hidden partition configs.
DiskIOThreshold	Tune thresholds for raw disk access outside expected drivers.
TimeWindow	Correlate boot-time anomalies with hidden file system mounting activity.

AN1272 · Linux

Unusual mounting of loopback or pseudo file systems not aligned with legitimate administrative activity. Defender view: monitoring auditd and syslog for mount commands involving suspicious mount points, reserved blocks, or device mappings indicative of hidden partitions.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
File ModificationDC0061	auditd:SYSCALL	mount or losetup commands creating hidden or encrypted FS
Command ExecutionDC0064	linux:syslog	Sudo or root escalation followed by filesystem mount commands

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
AllowedMountPoints	Whitelist standard mount points to reduce false positives.
UserContext	Flag root escalation during mount operations.

AN1273 · macOS

Hidden file system use through APFS containers or custom plist configuration. Defender view: anomalous use of hdiutil or diskutil to attach hidden partitions, modification of plist entries tied to system volumes, or suspicious raw disk access.

Log sources

The data this analytic draws on. You do not need every component — each one you already collect covers part of it. Each links to its ATT&CK record.

Data component	Name	Channel
Process CreationDC0032	macos:unifiedlog	Execution of diskutil or hdiutil attaching hidden partitions
File ModificationDC0061	macos:unifiedlog	Hidden volume attachment or modification events

Tunable fields

MITRE calls these the analytic’s mutable elements: the thresholds and filters you set for your own environment.

Field	What you tune
MonitoredPlistPaths	Adjust to target only relevant plist files linked to volume mounting.
ProcessScope	Restrict monitoring to sensitive processes like diskutil and hdiutil.

Hidden File System detections T1564.005

No detection rules are mapped to this technique yet.

None recorded— 33% of ATT&CK techniques have none either

Drag headers to reorder | Drag edges to resize

Loading detections...

Select	Title	Description	Category	Status	Event	Product	MITRE ATT&CK	CVEs	Severity	Author	Created	Updated	ID	Refs