Hello and welcome
to another application of the modern
tech framework discussion today
we're looking at hidden files and
directories within the defense
evasion component of the minor tech
framework.
So let's go ahead and look at our
objectives for today's discussion.
So we're going to describe for you
what hidden files and directories
are and how those work with respect
to actually hiding them, some
mitigation techniques.
And then we're going to get into
some detection techniques.
So within the hidden
files and directories, Vector is
essentially where files that
are typically hidden from end users.
To prevent them from accidentally
overriding or changing them
in this system are used to the
advantage of the threat actor.
All right. So they could use those
components to hide files
and folders on the system for
persistance or evading purpose.
So if you're not outright looking
for something that's hidden,
you're probably not going to look
for it. And if you're an end user,
chances are you're not looking for
it at all.
So how do they do it?
How can we do it?
Well, Windows Systems has
one way.
And so you can use the
attribute,
which is just a binary to
run the particular command here
against the file name to hide the
file. Now you can also
mark the file is hidden and
this allows you to
hide the file now within
the Mac or Linux environment,
putting a dot or a period
at the beginning of the file name
produces a file that will
be hidden or a folder
that will be hidden.
So looking at an example
in a Windows based system here, I
just took a few snippets.
So I've got my directory here
with my standard stuff.
Right.
But when I go in and change
my permissions or
I'm sorry, the
settings for viewing hidden
files and folders to the
show option,
I now see the secret
source data, which is a slightly
transparent looking file or
folder in this case.
But I'm not able to see that when
this particular component
is unchecked or it is sent to
the do not show
hidden files or folders
or drives. And so we can
even go as far as the hard drives on
the system.
So, again, by
default, you can't
search for these things.
You have to actually show hidden
files and folders and then you can
search for them. But it's not done
by default.
Now, some mitigation techniques
here are going to be things like end
user awareness training to prevent
the likelihood that payloads get on
the system
and then the implementation
of least privilege so that
if a user is compromised,
threat actors not able to use maybe
scripts and things of that nature to
write folder structures
or put files, hidden files
in directories or areas that
the end user would not otherwise be
able to access some
detection techniques.
Here we can
look for commands that add the
dot on the front of files
and Linux and Mac environments
especially, or when a command
is used
with the attribute
syntax.
And so if we have a script that's
run and it tries to hide files
now, something
else that we might be able to do
here, if we're looking for known bad
file names or we're familiar
with some indicators of compromise,
we could probably turn on
the hidden file function and do some
searches across systems for those
files.
But that would be cumbersome.
But it's certainly something you
could do to try to look for
suspicious information.
So let's do a quick check on
learning.
Hidden files are searchable by
default, true or false?
All right, well, if you need some
additional time, please pause the
video. So by default,
hidden files are not
searchable.
That goes for both Linux based
and one is based systems.
If you want to see hidden files and
Linux based systems, there's a
string for that.
And if you want to see hidden files
and windows based systems, you have
to make those files viewable
through the properties
for essentially you can go down
to the bottom of your
thing here
and I'll just pull it over
to the side. But when I type Hidden
says they're show hidden files and
folders when we hit
enter.
As you can see here,
we just have to click
so hidden files and hit apply
and then you can see hidden
files on the system.
So in summary of today's
discussion, we described
hidden files and directories.
Again, this can be used as a
mechanism for evading detection
or trying to keep things secret.
Squirrel on your secret sauce and
hidden away.
We reviewed some mitigation
techniques and then we did
detection techniques as
well.
So with that in mind, I want to
thank you for your time today,
and I look forward to seeing you
again soon.