Skip to content

Hide Artifacts

Technique · ATTACK:enterprise:T1564

Attributed source ↗ · Plaintext record · Complete record and assertions JSON

Inspect structured metadata and provenance

{
  "id": "ATTACK:enterprise:T1564",
  "title": "Hide Artifacts",
  "type": "Technique",
  "source_url": "https://attack.mitre.org/techniques/T1564",
  "snapshot": "enterprise-attack-20.0.json",
  "status": "active",
  "rights": "Source metadata only; source notices retained; no operational prose or payloads",
  "review_status": "machine-extracted; source-specific checks passed, editorial review pending",
  "stix_id": "attack-pattern--22905430-4901-4c2a-84f6-98243cb173f8",
  "external_id": "T1564",
  "domain": "enterprise",
  "created": "2020-02-26T17:41:25.933Z",
  "modified": "2026-05-12T15:12:00.623Z",
  "version": "2.0",
  "aliases": [

  ],
  "tactics": [
    "stealth"
  ],
  "source_references": [
    {
      "source_name": "Cybereason OSX Pirrit",
      "url": "https://cdn2.hubspot.net/hubfs/3354902/Content%20PDFs/Cybereason-Lab-Analysis-OSX-Pirrit-4-6-16.pdf"
    },
    {
      "source_name": "MalwareBytes ADS July 2015",
      "url": "https://blog.malwarebytes.com/101/2015/07/introduction-to-alternate-data-streams/"
    },
    {
      "source_name": "Sofacy Komplex Trojan",
      "url": "https://researchcenter.paloaltonetworks.com/2016/09/unit42-sofacys-komplex-os-x-trojan/"
    },
    {
      "source_name": "Sophos Ragnar May 2020",
      "url": "https://news.sophos.com/en-us/2020/05/21/ragnar-locker-ransomware-deploys-virtual-machine-to-dodge-security/"
    }
  ]
}

Explicit source assertions (25)

First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.

ATTACK:enterprise:S0402 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--08e05216-9133-4056-bbc9-b91ea0a7c6f5

Shlayer jamf gatekeeper bypass 2021 · sentinelone shlayer to zshlayer · 20 macOS Common Tools and Techniques

ATTACK:enterprise:T1564.003 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--26d64c06-c277-473d-94e8-e9990b6adc8e

ATTACK:enterprise:S0482 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2a4447dc-811d-487a-ade9-ef11e6e24e16

20 macOS Common Tools and Techniques

ATTACK:enterprise:M1033 → mitigates → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--2d30c053-3994-4a3b-b129-870f32edb008

ATTACK:enterprise:T1564.011 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--30a29f1a-41ec-4cf2-8d47-07c03c2d96e0

ATTACK:enterprise:T1564.002 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--33d1d2c7-fe6e-43c0-a78a-40ec218d0895

ATTACK:enterprise:T1564.012 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--3ee8ef8e-c4ad-4332-b4ff-3e45d9c21f66

ATTACK:enterprise:M1013 → mitigates → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--508cef53-f7ff-4e64-9ab3-dedefbba697b

ATTACK:enterprise:S0670 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--5bceaa15-bfcf-464f-a3d3-030d389080b5

Check Point Warzone Feb 2020

ATTACK:enterprise:T1564.014 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--60c1d632-4648-45ed-b5d3-271c2c4aa874

ATTACK:enterprise:M1047 → mitigates → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61e737e5-58d1-4a65-86e2-061466f2ff54

ATTACK:enterprise:T1564.008 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--61ea0450-24ef-4077-b5f4-2946e4eaa9b9

ATTACK:enterprise:S1066 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--662dd798-61ce-4463-8567-9acdecade943

Secureworks DarkTortilla Aug 2022

ATTACK:enterprise:T1564.009 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--6f7a4f3f-44ee-491f-be50-caa928214111

ATTACK:enterprise:T1564.013 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--7f1887f5-8e85-44c3-9f06-b29665be83ca

ATTACK:enterprise:T1564.006 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8b5b1096-80f7-43dd-a881-af92beac20f9

ATTACK:enterprise:T1564.010 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--8c9aa081-0e56-4f57-a54e-6decf6aab819

ATTACK:enterprise:M1049 → mitigates → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--a4139ea2-b04d-472a-9daa-0ff3eb5586ce

Microsoft File Folder Exclusions

ATTACK:enterprise:T1564.001 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--c848d2d3-ded6-45a0-b942-3763bbd10d5c

ATTACK:enterprise:S0332 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ca824912-36d7-4fa9-a2ea-b9b3da431b15

Fortinet Remcos Campaign NOV 2024

ATTACK:enterprise:S1011 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d507bcd4-bd22-4d39-b098-20c109ee9cda

Tarrask scheduled task

ATTACK:enterprise:S9025 → uses → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--d6a855be-0b7c-4a30-8759-e9506ca420b7

JPCERT MirrorFace JUL 2024

ATTACK:enterprise:T1564.004 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--dd434e57-9813-4e3f-ac86-f9ddc6313704

ATTACK:enterprise:T1564.007 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--ddff2aa4-975a-4a89-9c1d-b0a4b3a07b63

ATTACK:enterprise:T1564.005 → subtechnique-of → ATTACK:enterprise:T1564

MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.

Assertion source · Locator: relationship--e398ecb9-1e98-4518-aff8-aa18f527f9dc

Provided as is, for information only, with no warranty and no liability. Not legal or professional advice. Security and radio material is for authorized, lawful use only. Full disclaimer.

Visits are logged on our own server: IP address, browser and device details, and pages viewed. We use them to understand traffic and spot attacks, and never share or sell them.