Log in Request a demo

Attack technique

File and Directory Discovery

File and Directory Discovery is a technique where an attacker lists files and folders on a system or a network share to learn what is there.

In short

File and Directory Discovery is a technique where an attacker lists files and folders on a system or a network share to learn what is there. The results help the attacker decide what to do next, such as which data to take.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Discovery · Step 10 Of 15 In The Attack Chain

  1. MITRE IDT1083ATT&CK technique
  2. Detection4ways to spot itEnumeration from odd places · Access to restricted areas
  3. Defences2ways to stop itBuild a baseline

How it works

After getting onto a system, an attacker often does not know what it holds. Listing files and folders, or searching specific locations, gives a quick picture of the data and software present.

The attacker can use the ordinary file listing and search tools that come with the operating system. Custom tools and native system calls can do the same job. Network devices have their own commands for browsing storage.

What the attacker learns can shape later steps, including whether to go on and fully compromise the target.

A real example

  • MITRE ATT&CK lists 4H RAT as able to obtain file and directory listings.
  • MITRE ATT&CK lists AcidRain as identifying specific files and directories on Linux that relate to storage devices.
  • MITRE ATT&CK lists ADVSTORESHELL as able to list files and directories.
  • MITRE ATT&CK lists admin@338 as running directory listing commands after exploiting a machine with LOWBALL malware.
  • MITRE ATT&CK lists Amadey as searching for folders associated with antivirus software.

How to detect

  1. Enumeration from odd places

    Watch for file listing and search commands run by unusual processes, scripts or users, especially when they walk through many folders.

  2. Access to restricted areas

    Look for broad browsing of sensitive or restricted directories that does not match a person's normal work.

  3. Special platforms

    On virtualization hosts and network devices, watch for storage and configuration listing commands from unauthorized users or unfamiliar addresses.

  4. Data sources MITRE lists

    Command Execution, File Access, File Creation, Process Creation

How to defend

  1. Accept the limits of prevention

    MITRE notes that this technique cannot be easily prevented with controls, because it abuses normal system features.

  2. Build a baseline

    Know what normal administrator activity looks like, so that command and process monitoring can flag activity that does not fit.

Questions

What is File and Directory Discovery?

T1083 is when an attacker lists files and folders on a system or network share to learn what is there. The results help decide what to do next, such as which data to take.

How do attackers perform it?

They use the ordinary file listing and search tools that come with the operating system. Custom tools and native system calls can do the same job, and network devices have their own commands.

How can I detect file and directory discovery?

Watch for file listing and search commands run by unusual processes, scripts or users, and for broad browsing of sensitive directories that does not match a person's normal work.

Can file and directory discovery be prevented?

MITRE notes it cannot be easily prevented with controls because it abuses normal system features. Build a baseline of normal administrator activity so monitoring can flag what does not fit.

In our research

  1. Leaked Credentials from Ransomware Groups: Case Insights October 2025
  2. Donex Ransomware Technical Analysis August 2024
  3. KageNoHitobito Ransomware Technical Analysis August 2024
  4. Stone Gaze: In-Depth Analysis of Medusa Ransomware July 2024
  5. [Research Summary]: RokRat June 2024
  6. Xeno RAT Technical Analysis June 2024

Sources

  1. MITRE ATT&CK T1083: File and Directory Discovery MITRE
  2. MITRE ATT&CK Tactic TA0007: Discovery MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

Donex Ransomware Technical Analysis

Donex ransomware technical analysis: how the Windows malware encrypts local and network files, clears logs, maps to MITRE ATT&CK, and how to defend.

Read more

Threat group

APT18

APT18 (MITRE G0026) is described by MITRE ATT&CK as a threat group active since at least 2009, with targets in technology, manufacturing, government and medical sectors. A US health sector briefing (HHS HC3, 2020) lists suspected attribution to China; no advisory, indictment or named sponsor was found.

Read more

Glossary term

MITRE ATT&CK

MITRE ATT&CK is a globally-accessible knowledge base of adversary tactics and techniques based on real-world observations.

Read more