T1564Stealth
Hide Artifacts
Adversaries may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Adversaries may abuse these features to hide artifacts such as…
CVEs0
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.0
Reports0
Detections
10 Sigma rules tagged T1564Hide ArtifactsT156410 general rules
- Potentially Suspicious Execution From Parent Process In Public Folderhightest
- Suspicious Creation with Colorcplhightest
- Suspicious Executable File Creationhightest
- Sysmon Configuration Errorhightest
- Sysmon Configuration Modificationhightest
- CrashControl CrashDump Disabledmediumtest
- Mount Execution With Hidepid Parametermediumtest
- PUA - Process Hacker Executionmediumtest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to Hide Artifacts
0 CVEs, by priority. Each link shows its badge.No CVEs are linked to this technique yet.