T1083 · File and Directory Discovery

Sunturai

Detections can measure how the public catalogue is used — which detections people look for, and which pages bring them here. It sets a cookie that recognises this browser for 180 days. It is never linked to an account and never follows you to other sites. Privacy notice

T1083 · File and Directory Discovery · Sunturai

attack-patternenterprise-attackT1083

File and Directory Discovery

attack-pattern--7bc57495-ea59-4380-be31-a64af124ef18

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.

Created: May 31, 2017, 9:31 PM UTC
Modified: May 12, 2026, 3:12 PM UTC

63 published detections cover this technique

Every one carries the source it came from and the licence it was published under.

Detections covering this technique
Detection	Severity	Source	Published	Licence
Linux Auditd File And Directory Discovery	Informational	Splunk security content	Oct 13, 2026	Apache License 2.0
ESXi Virtual Disk Files Enumerated	Low	Elastic detection rules	Oct 2, 2026	Elastic License 2.0
Full Disk Access Permission Check	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious System Commands Executed by Previously Unknown Executable	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Yum/DNF Plugin Status Discovery	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious which Enumeration	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Memory grep Activity	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
SUID/SGUID Enumeration Detected	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Security File Access via Common Utilities	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Process Capability Enumeration	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Private Key Searching Activity	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kubeconfig File Discovery	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kernel Instrumentation Discovery via kprobes and tracefs	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ESXI Discovery via Grep	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
ESXI Discovery via Find	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Suspicious Dynamic Linker Discovery via od	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Keys Or Passwords Searched For Inside A Container	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
AWS Credentials Searched For Inside A Container	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Kubelet Pod Discovery Detected via Defend for Containers	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Sensitive Keys Or Passwords Search Detected via Defend for Containers	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Cloud Credential Search Detected via Defend for Containers	Medium	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Web Server Potential Remote File Inclusion Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Web Server Local File Inclusion Activity	Low	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Potential Credential Discovery via Recursive Grep	High	Elastic detection rules	Sep 20, 2026	Elastic License 2.0
Detect potential file enumeration activity (ASIM Web Session)	Medium	Microsoft Sentinel analytics	Sep 1, 2026	MIT License

Showing 25 of 63

Filter in the catalogue

External references

mitre-attackT1083Open reference

Windows Commands JPCERTOpen reference

US-CERT-TA18-106AOpen reference

Platforms

ESXiLinuxmacOSNetwork DevicesWindows

Kill chain phases

discovery

Relationships

Incoming and outgoing edges in the selected ATT&CK release.

Incoming and outgoing edges in the selected ATT&CK release
Direction	Type	Related object