T1083: File and Directory Discovery
Operational Executive Summary
T1083 (File and Directory Discovery) is classified under the Discovery tactic within the MITRE ATT&CK framework. Techniques adversaries employ to observe and orient themselves within an enterprise environment, profiling network shares, Active Directory domains, and local system configurations. In telemetry gathered across enterprise endpoints and the EMBER 2018 benchmark, this technique was weaponized across 60 distinct malware families, totaling over 17,853 validated samples.
Technical Anatomy & Adversary Tradecraft
Adversaries leverage File and Directory Discovery to accomplish operational objectives while minimizing anomalous forensic footprints. When executing File and Directory Discovery, malicious binaries commonly interact directly with low-level Windows APIs, kernel mode drivers, or native scripting interfaces to bypass traditional file-integrity monitors and static antivirus signatures.
In modern multi-stage campaigns, T1083 is frequently observed functioning as an intermediate bridge: initial access payloads (such as spearphishing loaders or exploit macros) execute File and Directory Discovery to establish in-memory execution or persistence before staging secondary ransomware or data-exfiltration implants.
Authoritative MITRE ATT&CK Reference: View official technique documentation, sub-techniques, and adversary groups at
https://attack.mitre.org/techniques/T1083/.
Detection Engineering & Threat Hunting
Detecting File and Directory Discovery requires telemetry correlation across endpoint detection and response (EDR) agents, Sysmon event streams, and security information event management (SIEM) pipelines:
- Process Creation & Lineage: Monitor parent-child process anomalies where unexpected parent binaries (e.g., Office executables, web browsers, or script hosts) spawn command shells or native Windows utilities.
- API Hooking & Behavioral Telemetry: EDR platforms should flag rapid calls to memory allocation, process injection, or registry manipulation APIs originating from unbacked executable memory regions.
- Network Anomaly Correlation: Cross-reference endpoint execution timestamps with external network socket establishment to identify anomalous beaconing or covert data staging.
SOC Containment & Hardening Guidance
To mitigate risks associated with T1083 (File and Directory Discovery) across production infrastructure, security teams should implement the following defensive controls:
- Attack Surface Reduction (ASR): Enforce strict application control policies (WDAC or AppLocker) to restrict execution to signed and verified corporate binaries.
- Least Privilege & Credential Hygiene: Restrict local administrative privileges to prevent adversaries from tampering with defensive agents or escalating privileges.
- Network Microsegmentation: Restrict lateral communication across endpoint VLANs to prevent wormable payloads from utilizing File and Directory Discovery across adjacent network segments.
Cataloged Malware Families Utilizing T1083 (60 Families)
The following malware families in the SystemHelpDesk catalog have been verified utilizing T1083 (File and Directory Discovery):
60 families
| Family | Category | Sample Count | Technical Summary |
|---|---|---|---|
| stop | Ransomware | 8,900 | STOP (universally recognized across consumer cybersecurity forums and threat feeds as STOP/Djvu) is the single most prevalent consumer ransomware family in cybe... |
| wannacry | Ransomware Worm | 4,876 | WannaCry (cataloged across security vendors and intelligence agencies as WanaCrypt0r, WCry, WannaCrypt, and Ransom.WannaCry) is an unprecedented global ransomwa... |
| simbot | Backdoor | 634 | Backdoor:Win32/Simbot (prominently tracked by US-CERT / CISA as the Taidoor RAT, and cataloged across vendor telemetry as BKDR_SIMBOT, Trojan:Win32/Simbot, or B... |
| gandcrypt | Ransomware | 474 | Ransom:Win32/GandCrypt (widely cataloged across endpoint telemetry as Trojan-Ransom.Win32.GandCrypt, Ransom.GandCrab, or Win32/GandCrypt) is the Microsoft Defen... |
| neshta | File Infector | 443 | Neshta (cataloged across cybersecurity authorities as Virus:Win32/Neshta.A, Virus.Win32.Neshta, and Win32/Neshta) is one of the most prolific, long-standing, an... |
| ausiv | Trojan | 422 | Ausiv (cataloged across security vendors as Trojan:Win32/Ausiv, Worm:Win32/Ausiv, and Trojan.Win32.Ausiv) is a hybrid Windows trojan and worm framework that eme... |
| expiro | File Infector | 305 | Expiro (classified across security vendors as Virus:Win32/Expiro, Virus:Win64/Expiro, and Xpiro) is one of the most sophisticated, long-lived polymorphic cross-... |
| sytro | Worm | 273 | Sytro (cataloged in antivirus encyclopedias as Worm:Win32/Sytro, P2P-Worm.Win32.Sytro, and Trojan:Win32/Sytro) is a peer-to-peer (P2P) network worm and download... |
| reconyc | Downloader | 222 | Reconyc (cataloged across security software as Trojan:Win32/Reconyc, Trojan.Win32.Reconyc, and Trojan.Reconyc) is a heavily obfuscated Windows trojan dropper an... |
| johnnie | Trojan | 221 | Johnnie (tracked in threat databases as Trojan:Win32/Johnnie, HackTool:Win32/Johnnie, and Worm:Win32/Johnnie) is a Windows trojan, reconnaissance hacktool, and ... |
| jeefo | File Infector | 213 | Jeefo (also known as Hidrag, and cataloged in security vendor encyclopedias as Virus:Win32/Jeefo.A, PE_JEEFO.A, and Virus.Win32.Hidrag.a) is a classic parasitic... |
| hydracrypt | Ransomware | 180 | HydraCrypt is a destructive crypto-ransomware family that surfaced in early 2016, engineered directly from the leaked source code of the CrypBoss ransomware fam... |
| parite | File Infector | 163 | Parite (tracked across cybersecurity vendor signatures as Virus:Win32/Parite.B, Virus.Win32.Parite.b, Pinfi, PE_PARITE.A, and W32.Pinite) is an infamous, highly... |
| benjamin | Worm | 153 | Benjamin (cataloged across antivirus vendors as Worm:Win32/Benjamin.A, W32.Benjamin.Worm, and P2P-Worm.Win32.Benjamin) is an infamous legacy peer-to-peer (P2P) ... |
| blamon | Ransomware | 22 | Blamon (tracked across endpoint security telemetry under signatures Ransom:Win32/Blamon, Ransom:Win32/Blamon.A, and Trojan-Ransom.Win32.Blamon) is a destructive... |
| elzob | Ransomware | 22 | Elzob (identified in security research telemetry as Ransom:Win32/Elzob, Trojan-Ransom.Win32.Elzob, and Win32/Elzob) is an aggressive Windows ransomware family a... |
| krucky | Ransomware | 22 | Krucky (tracked in malware research telemetry under designations including Ransom:Win32/Krucky, Ransom:Win32/Krucky.A, and Trojan-Ransom.Win32.Krucky) is a dest... |
| golroted | Ransomware | 21 | Golroted (classified across antimalware engines under designations including Ransom:Win32/Golroted, Trojan-Ransom.Win32.Golroted, and Win32/Golroted) is a destr... |
| pajetbin | Ransomware | 21 | Pajetbin (classified across threat telemetry as Ransom:Win32/Pajetbin, Trojan-Ransom.Win32.Pajetbin, and Win32/Pajetbin) is a destructive crypto-ransomware fami... |
| schoolboy | Ransomware | 21 | Schoolboy (identified in endpoint telemetry as Ransom:Win32/Schoolboy, Trojan-Ransom.Win32.Schoolboy, and Win32/Schoolboy) is a targeted crypto-ransomware famil... |
| tonmye | Ransomware | 21 | Tonmye (tracked across antimalware research as Ransom:Win32/Tonmye, Trojan-Ransom.Win32.Tonmye, and Win32/Tonmye) is a destructive crypto-ransomware family targ... |
| blihan | Ransomware | 20 | Blihan (classified in endpoint telemetry as Ransom:Win32/Blihan, Trojan-Ransom.Win32.Blihan, and Win32/Blihan) is an aggressive crypto-ransomware family designe... |
| pasta | Ransomware | 20 | Pasta (identified in antimalware telemetry under signatures Ransom:Win32/Pasta, Trojan-Ransom.Win32.Pasta, and Win32/Pasta) is an extortion crypto-ransomware fa... |
| qzonit | Ransomware | 20 | Qzonit (cataloged across global antimalware repositories under designations including Ransom:Win32/Qzonit, Trojan-Ransom.Win32.Qzonit, and Win32/Qzonit) is a ta... |
| wdjiange | Ransomware | 20 | Wdjiange (classified in threat research telemetry under signatures Ransom:Win32/Wdjiange, Trojan-Ransom.Win32.Wdjiange, and Win32/Wdjiange) is an aggressive Win... |
| crusis | Ransomware | 19 | Crusis (widely known in the cybersecurity community as the CrySiS or Dharma ransomware family and cataloged by Microsoft as Ransom:Win32/Crusis) is an infamous ... |
| xorist | Ransomware | 15 | Xorist (classified across the cybersecurity industry as Ransom:Win32/Xorist, Trojan-Ransom.Win32.Xorist, and Enigma/Xorist builder family) is a landmark, highly... |
| xpaj | File Infector | 14 | Xpaj (historically documented as Virus:Win32/Xpaj, W32/Xpaj, and Trojan.Xpaj) is a sophisticated polymorphic parasitic file infector and click-fraud botnet fami... |
| cryptos | Ransomware | 10 | Ransomware:Win32/Cryptos is a generic heuristic detection used by antivirus engines to identify early, varied, or obfuscated forms of encryption-based ransomwar... |
| pony | Infostealer | 10 | Pony (cataloged across cybersecurity authorities as Fareit, Siplog, Trojan:Win32/Fareit, and PWS:Win32/Fareit) is one of the most prolific commodity information... |
| teslacrypt | Ransomware | 9 | TeslaCrypt is a notorious ransomware family first detected in February 2015 that achieved widespread prominence by specifically targeting video gamers—encryptin... |
| bitman | Ransomware | 8 | Bitman (classified in antivirus detection telemetry under designations including Ransom:Win32/Bitman, Ransom.Win32.Bitman, and Win32/Bitman) is a crypto-ransomw... |
| collector | Trojan | 8 | Spyware:Win32/Collector is a specialized Information Stealer (Infostealer) trojan designed to silently harvest and exfiltrate highly specific sets of data from ... |
| grenam | Advanced Threat | 7 | Worm:Win32/Grenam (also known as a generic network worm or **File Infector**) is a self-replicating malware family that aggressively spreads across network shar... |
| virledi | Trojan | 7 | Virus:Win32/Virledi is a destructive and parasitic **File Infector**. Unlike standard trojans which simply run alongside legitimate programs, Virledi actively s... |
| cyn | File Infector | 5 | Cyn (cataloged across classical antivirus telemetry as Virus:DOS/Cyn and Virus:Win32/Cyn) is an early parasitic file infector originally engineered for MS-DOS e... |
| strongpity | Trojan | 5 | Trojan:Win32/Strongpity (also known as Promethium or APT-C-41) refers to both an Advanced Persistent Threat (APT) group and their associated custom malware tool... |
| filefinder | Ransomware | 4 | Spyware:Win32/Filefinder is a specialized information-stealing trojan designed explicitly for data exfiltration and reconnaissance. Unlike broad stealers that g... |
| pyfiledel | Ransomware | 4 | Trojan:Python/Pyfiledel is a highly destructive malware classified as a **Wiper**. Unlike ransomware, which encrypts files with the intention of extorting money... |
| democry | Ransomware | 3 | Ransomware:Win32/Democry is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware variant... |
| myransom | Ransomware | 3 | Ransomware:Win32/Myransom is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varian... |
| ransomkd | Ransomware | 3 | Ransom:Win32/Ransomkd is a generic heuristic detection used by antivirus engines to identify executables that exhibit behavior typical of **Cryptographic Ransom... |
| tovicrypt | Ransomware | 3 | Ransomware:Win32/Tovicrypt is a generic detection applied to a variety of simpler, often commercially available or 'script-kiddie' level crypto-ransomware varia... |
| vbcryptor | Ransomware | 3 | Ransomware:Win32/Vbcryptor is a broad detection name applied to various strains of ransomware, file encoders, and malicious crypters that are compiled using Mic... |
| kates | Trojan | 2 | Virus:Win32/Kates is a parasitic file infector virus that specifically targets executable files (`.exe` and `.dll`) on the compromised system. Unlike a trojan t... |
| cryptowall | Ransomware | 1 | CryptoWall is a family of file-encrypting ransomware analyzed by the Dell SecureWorks Counter Threat Unit (CTU). First analyzed in late February 2014 but distri... |
| stampado | Ransomware | 1 | Ransom:Win32/Stampado is a notorious example of cheap 'Ransomware-as-a-Service' (RaaS). Unlike advanced ransomware families that demand massive payouts from cor... |
| acid_drop | Trojan | Sampled | Acid Drop (also documented in historical archives as AcidDrop or Backdoor.AcidDrop) is a vintage remote access backdoor and Trojan horse originating in the late... |
| back_orifice | Backdoor | Sampled | Back Orifice, created by the hacker group Cult of the Dead Cow (cDc) and released in 1998, is one of the most infamous remote administration tools (RATs) in cyb... |
| prjraptor | Trojan | Sampled | PrjRAPTOR (frequently documented as Project Raptor, PrjRaptor, or Backdoor.PrjRaptor) was an early-2000s hacktool and Remote Access Trojan prominent in the retr... |
| serenity_rat | Rat | Sampled | Serenity RAT (cataloged across security software as Backdoor.Win32.Serenity, Trojan.Serenity, and Serenity RAT) is a mid-2000s Remote Access Trojan created in B... |
| sinique | Trojan | Sampled | Sinique (historically documented across threat intelligence archives as Sinique Trojan, Sinique 1.0, and Backdoor.Sinique) is an early 2000s remote access troja... |
| trojna | Trojan | Sampled | Trojna (cataloged across early antivirus archives as TrojNa$, Trojan.Trojna, and Backdoor.Win32.Trojna) is an early-2000s Remote Access Trojan created in Visual... |
| ulysses | Trojan | Sampled | Ulysses (cataloged across security archives as Ulysses RAT, Trojan.Win32.Ulysses, and Backdoor.Win32.Ulysses) is an early 2000s Remote Access Trojan created in ... |
| universal1337 | Infostealer | Sampled | Universal 1337 (cataloged across security definitions as Universal1337, Trojan.Universal1337, and Universal1337 by Eddy-K) is an early 2000s credential extracti... |
| vampire | Trojan | Sampled | Vampire (also documented across security definitions as Vampire RAT, Vampire Trojan, and Backdoor.Win32.Vampire) is a vintage Remote Access Trojan created in 20... |
| vbs_worm_generator | Worm | Sampled | VBS Worm Generator (widely known as VBSWG and documented in security records as Worm.VBSWG or VBS Worm Generator by [K]Alamar) is an infamous malware constructi... |
| y3k_rat | Trojan | Sampled | Y3K RAT (cataloged across legacy security archives as Y3K 1.6, Backdoor.Y3K, and Trojan.Win32.Y3K) is an iconic early-2000s Remote Access Trojan created in Visu... |
| z_dem0n | Trojan | Sampled | Z-dem0n (often styled as Z-dem0n, Z-Demon, or Backdoor.Win32.ZDemon) is an early-2000s Remote Access Trojan created in Delphi around 2002 by a developer using t... |
| zombierat | Trojan | Sampled | ZombieRAT (also cataloged across antimalware archives as ZombieRat, Backdoor.Win32.ZombieRat, and Zombie RAT by The Bo$$) is an early-to-mid 2000s Remote Access... |