File and Directory Discovery

What is File and Directory Discovery?

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully invests in a compromise. On Windows systems, attackers use dir commands, tree, and PowerShell cmdlets to enumerate directory structures. On Linux, find, ls, and locate are commonly used for file system reconnaissance. Attackers search for sensitive files including configuration files with credentials, database files, source code repositories, backup files, SSH private keys, and documents containing confidential business information. The goal is to identify valuable data to exfiltrate and to find additional credentials that can be used for further access.

“File and Directory Discovery is documented as technique T1083 in the MITRE ATT&CK knowledge base under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify File and Directory Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for file system enumeration commands particularly those searching for file types commonly associated with credentials and sensitive data such as *.kdbx, *.pfx, *.key, id_rsa, *.config, and *.rdp files.

2. 2

   Alert on processes accessing large numbers of files in quick succession, particularly across multiple directories, as this pattern is consistent with automated file search operations rather than normal user activity.

3. 3

   Detect searches targeting specific sensitive directories including backup locations, certificate stores, SSH key directories, and application configuration paths that are not normally accessed by standard user processes.

4. 4

   Monitor for PowerShell Get-ChildItem or Select-String commands searching for specific keywords like password, credential, secret, or token within file contents, which indicates targeted credential harvesting.

5. 5

   Track access to network shares by monitoring SMB access logs, alerting on accounts accessing shares outside of their normal job function or accessing large numbers of files across multiple share locations rapidly.

Example Alerts

These realistic alert examples show what File and Directory Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect File and Directory Discovery?

SOC analysts detect File and Directory Discovery (T1083) by monitoring XDR, SIEM telemetry for behavioral anomalies and specific indicators. Key detection methods include monitor for file system enumeration commands particularly those searching for file types commonly associated with credentials and sensitive data such . SOCSimulator provides hands-on practice detecting this technique with realistic alerts.

What security tools are used to detect File and Directory Discovery?

File and Directory Discovery can be detected using XDR, SIEM platforms. XDR tools are particularly effective for this technique because they provide visibility into the discovery phase of the attack chain. SOCSimulator simulates all three tool types for hands-on training.

How common is File and Directory Discovery in real-world attacks?

File and Directory Discovery is a well-documented MITRE ATT&CK technique in the Discovery tactic. It appears in threat intelligence reports from multiple security vendors and has been observed in campaigns by various threat actor groups. SOCSimulator includes realistic File and Directory Discovery scenarios based on documented attack patterns, helping analysts build detection intuition.

Can I practice detecting File and Directory Discovery for free?

Yes. SOCSimulator offers free forever access to training scenarios, including Discovery techniques like File and Directory Discovery. You can investigate realistic alerts in guided Operations rooms, build detection skills with SIEM, XDR, and Firewall interfaces, and test yourself under pressure in Shift Mode. No credit card required.