TA0005 · DEFENSE EVASION
Hidden File System
Adversaries may use a hidden file system to conceal malicious activity from users and security tools. File systems provide a structure to store and access data from physical storage.
Detect it with
Detecting the use of a hidden file system may be exceptionally difficult depending on the implementation.
Why it matters on shift
Hidden File System is one of the concrete ways adversaries achieve defense evasion. Recognising it in telemetry lets you name the technique in your ticket and pivot to what came before and after.
What to look for next
After defense evasion, the next tactic is usually Credential Access. Search your telemetry for the transition before closing the ticket.
Kill-chain context