Skip to content
Sign In
Learn

T1083

File and Directory Discovery

What it is

Attackers list files and folders to find what is worth stealing, where credentials or backups are kept, and where to place their own tools. It is a technique under the Discovery tactic. Recursive listings of user folders and file shares often come shortly before data is gathered and taken out, so they can give early warning.

How adversaries use it

The attacker lists folders with built-in commands, such as dir /s and tree on Windows, ls and find on Linux, or Get-ChildItem in PowerShell. They search for document types, key files and configuration files, often across a whole user profile or file share, and save the listing to a file so they can read it later or copy it out.

Detect it in Elastic

Data source: Windows and Linux process creation events

Key fields

event.code: 1 (Sysmon) or 4688 (Windows Security) on Windows; event.action: executed on Linux (Auditbeat) process.name: the listing tool, such as tree.com, find or a command shell process.command_line (Windows) or process.args (Linux): the folder and options, such as a recursive search user.name: the account that ran it host.name, @timestamp

Example event

{
  "host": {
    "name": "ws-214.corp.example"
  },
  "user": {
    "name": "m.castell"
  },
  "event": {
    "code": "1"
  },
  "process": {
    "name": "tree.com",
    "parent": {
      "name": "wscript.exe"
    },
    "command_line": "tree E:\\Depot /f"
  },
  "@timestamp": "2026-05-14T09:36:48.902Z"
}

Prebuilt Elastic rule: System Information Discovery via Windows Command Shell

Hunt guidance

Windows Security 4688 events include the command line only when the "Include command line in process creation events" policy is on. Start with recursive listings: process.command_line: (*dir* and */s*) or process.command_line: *Get-ChildItem*-Recurse*. Then read where they looked and where the output went. Look for listings of other users' folders or whole file shares, output saved to public or temporary folders, searches for document or key file types, and listings that follow other discovery commands from the same account. The prebuilt rule named on this page looks for a narrower pattern and wouldn't fire on the example event above, so use it alongside this hunt, not instead of it.

Ruling out legitimate activity

Users browse their own files, and backup, indexing and antivirus tools read folders constantly, though those rarely run as visible commands. Focus on command-line listings by accounts that don't usually use a shell, on folders the account doesn't own, and on listings written to a file.

Telemetry needed

The log events that help detect this technique, from the Telemetry reference: which log source to collect, which event in it, and how to enable each one.

References

Practice it

No range covers this technique yet; the write-up above landed first. Ranges are added continuously; the ones live today are on the training ladder.