Defense Evasion. Hide Artifacts (MiTRE ID:T1564)

An artifact can simply be defined as an important system file, which thus includes documentation, test plans, images, and even some executable modules. Operating systems have a feature to hide these artifacts in order to avoid disrupting user work environments and prevent users from changing files or features on the system.

However, an attacker can abuse these functionalities in order to carry out his evil intents by hiding these artifacts, which thus provides a clear path to evade detection. Let’s try to understand the above statement by taking a simple example. Once the attacker has his payload hidden, he can now carry it out for his malicious intent by tricking the system administrator.

With that said, let’s have a look at the various approaches that the attackers take to evade their presence.

#pentest

Android Penetration Testing, 2023

Deep Link Exploration

#pentest #mobile

Exploiting Reversing (ER) series: article 01

The first article (109 pages) in the Exploiting Reversing (ER) series

Source

#reverse

Повышение привилегий на узлах локальной сети (в ОС Windows), CyberED, 2023

#pentest #windows