Hide Artifacts detection rulesT1564

Detects creation of persistence artifacts placed by Atomic MacOS Stealer in macOS systems. Recent Atomic MacOS Stealer variants have been observed dropping these to maintain persistent access after compromise.

macos · file_event

Exports the target Registry key and hides it in the specified alternate data stream.

windows · create_stream_hash

Detects execution of chromium based browser in headless mode using the "dump-dom" command line to download files

windows · process_creation

Detects suspicious command lines used in Covenant luanchers

windows · process_creation

Detects the creation of a named file stream with the imphash of a well-known hack tool

windows · create_stream_hash

Detects modifications to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

windows · registry_set

Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.

windows · ps_script

Detects chromium based browsers starting in headless and debugging mode and pointing to a user profile. This could be a sign of data stealing or remote control

windows · process_creation

Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).

windows · process_creation

Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.

windows · process_creation

Detects changes to the registry for the currently logged-in user. In order to disable PowerShell module logging, script block logging or transcription and script execution logging

windows · registry_set

Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.

windows · process_creation

Detects the modification of the registry to allow a driver or service to persist in Safe Mode.

windows · registry_set

Detects PowerShell script execution from Alternate Data Stream (ADS)

windows · process_creation

Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs

windows · process_creation

Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\

windows · file_event

Detect creation of suspicious executable file names. Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.

windows · file_event

Detects the download of suspicious file type from a well-known file and paste sharing domain

windows · create_stream_hash

Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages

windows · sysmon_error

Detects when an attacker tries to hide from Sysmon by disabling or stopping it

windows · sysmon_status

Detects the download of suspicious file type from URLs with IP

windows · create_stream_hash

Detects cmd.exe executing commands with the "start" utility using "/b" (no window) or "/min" (minimized) flags. To reduce false positives from standard background tasks, detection is restricted to scenarios where the target is a known script extension or located in suspicious temporary/public directories. This technique was observed in Chaos, DarkSide, and Emotet malware campaigns.

windows · process_creation

Detects disabling the CrashDump per registry (as used by HermeticWiper)

windows · registry_set

Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files. This technique is abused by several malware families to hide their files from normal users.

windows · registry_set

Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection

windows · process_creation

Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash

windows · create_stream_hash

Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS. When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.

macos · process_creation

Detects creation of a hidden user account on macOS (UserID < 500) or with IsHidden option

macos · process_creation

Detects usage of attrib.exe to hide files from users.

windows · process_creation

Detects changes to the registry key "HKLM\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\SpecialAccounts\Userlist" where the value is set to "0" in order to hide user account from being listed on the logon screen.

windows · process_creation

Detects inbox rule creation or update via O365 Audit logs, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

m365

Detects inbox rule creation or update via ExchangePowerShell cmdlet, a technique commonly observed in Business Email Compromise (BEC) attacks to hide emails. The usage of inbox rules can be a sign of a compromised mailbox, where an attacker is attempting to evade detections by suppressing or redirecting incoming emails. Analysts should review these rules in context, validate whether they reflect normal user behavior, and correlate with other indicators such as unusual login activity or recent mailbox rule modifications.

windows · ps_script

Detects email forwarding or redirecting activity in O365 Audit logs.

m365

Detects email forwarding or redirecting activity via ExchangePowerShell Cmdlet

windows · ps_script

Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system

linux · process_creation

Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"

windows · file_event

Detects command line containing reference to the "::$index_allocation" stream, which can be used as a technique to prevent access to folders or files from tooling such as "explorer.exe" or "powershell.exe"

windows · process_creation

Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy

windows · process_creation

Detects the use of powershell commands from headless ConHost window. The "--headless" flag hides the windows from the user upon execution.

windows · process_creation

Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.

windows · ps_script

Detects the execution of AdvancedRun utility

windows · process_creation

Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc). Process Hacker is a tool to view and manipulate processes, kernel options and other low level options. Threat actors abused older vulnerable versions to manipulate system processes.

windows · process_creation

Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations

windows · process_creation

Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.

windows · process_creation

Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.

windows · process_creation

Extract data from cab file and hide it in an alternate data stream

windows · process_creation

Adversaries may carry out malicious operations using a virtual instance to avoid detection

windows · ps_script

Adversaries may use hidden windows to conceal malicious activity from the plain sight of users. In some cases, windows that would typically be displayed when an application carries out an operation can be hidden

windows · ps_script

Detects the download of suspicious file type from a well-known file and paste sharing domain

windows · create_stream_hash

Detect use of icacls to deny access for everyone in Users folder sometimes used to hide malicious files

windows · process_creation

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection

windows · process_creation

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection

windows · process_creation

Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. When investigating, examine: - Commands using short paths to access sensitive directories or files - Web servers on Windows (especially Apache) where short filenames could bypass security controls - Correlation with other suspicious behaviors - baseline of short name usage in your environment and look for deviations

windows · process_creation

Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image detection

windows · process_creation

Detects execution of Chromium based browser in headless mode

windows · process_creation

Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character

linux

Detects execution of findstr with the "s" and "i" flags for a "subfolder" and "insensitive" search respectively. Attackers sometimes leverage this built-in utility to search the system for interesting files or filter through results of commands.

windows · process_creation

Detects the execution of "attrib" with the "+s" flag to mark files as system files

windows · process_creation

Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.

windows · process_creation