Log in Request a demo

Attack technique

Hide Artifacts

Hide Artifacts is a technique where attackers hide the traces of their activity, such as files, folders, user accounts or running tasks.

In short

Hide Artifacts is a technique where attackers hide the traces of their activity, such as files, folders, user accounts or running tasks. The aim is to avoid being noticed by users and security tools. Attackers abuse operating system features that already hide items, so what is hidden is harder to find during a routine check. MITRE ATT&CK tracks it as T1564.

Last updated 8 October 2026

Profile MapTechnique
  1. Reconnaissance
  2. Resource Development
  3. Initial Access
  4. Execution
  5. Persistence
  6. Privilege Escalation
  7. Stealth
  8. Defense Impairment
  9. Credential Access
  10. Discovery
  11. Lateral Movement
  12. Collection
  13. Command and Control
  14. Exfiltration
  15. Impact

Stealth · Step 7 Of 15 In The Attack Chain

  1. MITRE IDT1564ATT&CK technique
  2. Detection4ways to spot itChanges that hide files · Hidden content in documents
  3. Defences4ways to stop itAudit exclusions · Audit virtual machines

How it works

Operating systems have features that hide certain items, such as important system files or background tasks. This keeps normal work environments tidy and stops users from changing things by accident.

Attackers can abuse these same features to hide files, directories, user accounts or other system activity that belongs to their operation. What is hidden is then harder to find during a routine check.

Attackers may also create a region on the system that is cut off from common security tools, for example by using virtualization. Activity inside it is not seen by the tools watching the main system.

MITRE lists 14 sub-techniques: T1564.001 Hidden Files and Directories, T1564.002 Hidden Users, T1564.003 Hidden Window, T1564.004 NTFS File Attributes, T1564.005 Hidden File System, T1564.006 Run Virtual Instance, T1564.007 VBA Stomping, T1564.008 Email Hiding Rules, T1564.009 Resource Forking, T1564.010 Process Argument Spoofing, T1564.011 Ignore Process Interrupts, T1564.012 File/Path Exclusions, T1564.013 Bind Mounts and T1564.014 Extended Attributes.

A real example

MITRE ATT&CK lists these procedure examples:

  • Remcos can change file attributes to hide a file.
  • Tarrask creates hidden scheduled tasks by deleting the Security Descriptor registry value.
  • NOOPLDR can hide services used to help execution.

How to detect

  1. Changes that hide files

    Watch for actions that set hidden or system attributes on files, create hidden data streams, or change settings that affect what is visible.

  2. Unexpected hidden items in system locations

    Look for hidden files, scheduled jobs or startup entries placed in unusual hidden folders, especially on Linux and macOS.

  3. Hidden content in documents

    Check Office documents for hidden macro streams or embedded objects, and link them to unusual program execution.

  4. Detection strategy MITRE lists

    DET0502, Detection Strategy for Hidden Artifacts Across Platforms.

How to defend

  1. Audit exclusions

    Review file and folder exclusions in antivirus tools and keep them as narrow as possible, since excluded locations are not scanned.

  2. Limit software that can hide activity

    Restrict installation of software that can create hidden desktops to the groups that really need it.

  3. Audit virtual machines

    Review virtual machines regularly for anything unusual, as they can be used to run activity out of sight.

  4. Guidance for application developers

    Avoid requirements for hard-to-manage exclusions, and install applications in trusted system folders that already have strict permissions.

Questions

What is the Hide Artifacts technique?

It is a technique where attackers hide files, directories, user accounts or other system activity that belongs to their operation. They abuse features that operating systems already use to hide items. MITRE ATT&CK tracks it as T1564.

How do attackers hide artifacts on a system?

They abuse operating system features that hide files, folders, accounts or tasks. They may also create a region cut off from common security tools, for example by using virtualization, so activity inside it is not seen by the tools watching the main system.

How can defenders detect hidden artifacts?

Watch for actions that set hidden or system attributes on files or create hidden data streams. Look for hidden files, scheduled jobs or startup entries in unusual folders, and check Office documents for hidden macro streams.

How do you defend against Hide Artifacts?

Review antivirus exclusions and keep them as narrow as possible, since excluded locations are not scanned. Restrict software that can create hidden desktops, and review virtual machines regularly for anything unusual.

In our research

  1. Donex Ransomware Technical Analysis August 2024
  2. Equation APT Group September 2022
  3. Mythic Leopard APT Group August 2022
  4. Fancy Bear APT Group August 2022
  5. APT19 Threat group
  6. APT36 Threat group

Sources

  1. MITRE ATT&CK T1564: Hide Artifacts MITRE
  2. MITRE ATT&CK TA0005: Stealth MITRE

Browse the threat library

Keep exploring

Knowledge Hub

Article

Donex Ransomware Technical Analysis

Donex ransomware technical analysis: how the Windows malware encrypts local and network files, clears logs, maps to MITRE ATT&CK, and how to defend.

Read more

Article

Equation APT Group

Equation Group profile: operations since 2001, zero-day exploits, hard drive firmware persistence, self-destructing malware and links to Stuxnet and Flame.

Read more

Threat group

APT19

MITRE ATT&CK describes APT19 (also Codoso) as a Chinese-based group that has targeted defense, finance, legal and other industries, with activity reported in 2014 and 2017. Only MITRE ATT&CK documents this group, no government advisory names it, and MITRE says it is unclear whether APT19 and Deep Panda are the same group.

Read more

Threat group

APT36

MITRE ATT&CK describes Transparent Tribe, also called APT36, as a suspected Pakistan-based threat group that has been active since at least 2013. It mainly targets diplomatic, defense and research organizations in India and Afghanistan with weaponized documents, lookalike websites and remote access trojans such as Crimson.

Read more