Technique:  File and Directory Discovery
3PARA RAT has a command to retrieve metadata for files on disk as well as a command to list the current working directory.
4H RAT has the capability to obtain file and directory listings.
Action RAT has the ability to collect drive and file information on an infected machine.
It actors used the following commands after exploiting a machine with LOWBALL malware to obtain information about files and directories: dir c:\ >> %temp%\download dir "c:\Documents and Settings" >> %temp%\download dir "c:\Program Files\" >> %temp%\download dir d:\ >> %temp%\download
ADVSTORESHELL can list files and directories.
Amadey has searched for folders associated with antivirus software.
It has run scripts to identify file formats including Microsoft Word.
AppleSeed has the ability to search for .txt, .ppt, .hwp, .pdf, and .doc files in specified directories.
It can list files information for specific directories.
It has used Forfiles to locate PDF, Excel, and Word documents during collection. The group also searched a compromised DCCC computer for specific terms.
It has a tool that looks for files and directories on the local file system.
It's backdoor possesses the capability to list files and directories on a machine.
It have enumerated files and directories, or searched in specific locations within a compromised host.
It has used tools with the ability to search for files on a compromised host.
It has executed file /bin/pwd on exploited victims, perhaps to return architecture related information.
Aria-body has the ability to gather metadata from a file and to search for file and directory names.
Attor has a plugin that enumerates files with specific extensions on all hard disk drives and stores file information in encrypted log files.
AuditCred can search through folders and files on the system.
AutoIt backdoor is capable of identifying documents on the victim with the following extensions: .doc; .pdf, .csv, .ppt, .docx, .pst, .xls, .xlsx, .pptx, and .jpeg.
Avaddon has searched for specific files prior to encryption.
Avenger has the ability to browse files in directories such as Program Files and the Desktop.
AvosLocker has searched for files and directories on a compromised network.
Azorult can recursively search for files in folders and collects files from the desktop with certain extensions.
Babuk has the ability to enumerate files on a targeted system.
BabyShark has used dir to search for "programfiles" and "appdata".
BackConfig has the ability to identify folders and files related to previous infections.
Backdoor.Oldrea collects information about available drives, default browser, desktop file list, My Documents, Internet history, program files, and root of available drives. It also searches for ICS-related software files.
BACKSPACE allows adversaries to search for files.
BADFLICK has searched for files on the infected host.
BADNEWS identifies files with certain extensions from USB devices, then copies them to a predefined directory.
BadPatch searches for files with specific file extensions.
Bandook has a command to list files on a system.
Bankshot searches for files on the victim's machine.
Bazar can enumerate the victim's desktop.
BBSRAT can list file and directory information.
Bisonal can retrieve a file listing from the system.
Black Basta can enumerate specific files for encryption.
BlackCat can enumerate files for encryption.
BLACKCOFFEE has the capability to enumerate files.
BlackEnergy gathers a list of installed apps from the uninstall program Registry. It also gathers registered mail, browser, and instant messaging clients from the Registry. BlackEnergy has searched for given file types.
BlackMould has the ability to find files on the targeted system.
BLINDINGCAN can search, read, write, move, and execute files.
BLUELIGHT can enumerate files and collect associated metadata.
BoomBox can search for specific files and directories on a machine.
BoxCaon has searched for files on the system, such as documents located in the desktop folder.
Brave Prince gathers file and directory information from the victim’s machine.
It has collected a list of files from the victim and uploaded it to its C2 server, and then created a new list of specific files to steal.
During C0015, the threat actors conducted a file listing discovery against multiple hosts to ensure locker encryption was successful.
CaddyWiper can enumerate all files and directories on a compromised host.
Cannon can obtain victim drive information as well as a list of folders in C:\Program Files.
Cardinal RAT checks its current working directory upon execution and also contains watchdog functionality that ensures its executable is located in the correct path (else it will rewrite the payload).
Caterpillar WebShell can search for files in directories.
ccf32 can parse collected files to identify specific file extensions.
CharmPower can enumerate drives and list the contents of the C: drive on a victim's computer.
ChChes collects the victim's %TEMP% directory path and version of Internet Explorer.
It has utilized multiple commands to identify data of interest in file and directory listings.
China Chopper's server component can list directory contents.
An older version of CHOPSTICK has a module that monitors all mounted volumes for files with the extensions .doc, .docx, .pgp, .gpg, .m2f, or .m2o.
Clambling can browse directories on a compromised host.
Clop has searched folders and subfolders for files to encrypt.
cmd can be used to find files and directories with native functionality such as dir commands.
Cobalt Strike can explore files on a compromised system.
It has used a file stealer that checks the Document, Downloads, Desktop, and Picture folders for documents and images with specific extensions.
Conti can discover files on a local system.
CookieMiner has looked for files in the user's home directory with "wallet" in their name using find.
CORALDECK searches for specified files.
CosmicDuke searches attached and mounted drives for file extensions and keywords that match a predefined list.
CrackMapExec can discover specified filetypes and log files on a targeted system.
CreepyDrive can specify the local file path to upload files from.
Crimson contains commands to list files and directories, as well as search for files matching certain extensions from a defined list.
CrossRAT can list all files on a system.
Cryptoistic can scan a directory to identify files for deletion.
Cuba can enumerate files by using a variety of functions.
Cyclops Blink can use the Linux API statvfs to enumerate the current working directory.
Dacls can scan directories on a compromised host.
It collected file listings of all default Windows directories.
It has used malware that searched for files with specific patterns.
DarkWatchman has the ability to enumerate file and folder names.
DDKONG lists files on the victim’s machine.
DEATHRANSOM can use loop operations to enumerate directories on a compromised host.
Denis has several commands to search directories for files.
Derusbi is capable of obtaining directory, file, and drive listings.
Diavol has a command to traverse the files and directories in a given path.
Doki has resolved the path of a process PID to use as a script argument.
down_new has the ability to list the directories on a compromised host.
It has used a batch script to gather folder and file names from victim hosts.
DropBook can collect the names of all files and folders in the Program Files directories.
Dtrack can list files on available disk volumes.
DustySky scans the victim for files that contain certain keywords and document types including PDF, DOC, DOCX, XLS, and XLSX, from a list that is obtained from the C2 as a text file. It can also identify logical drives for the infected machine.
Ebury can list directory entries.
A variant of Elise executes dir C:\progra~1 when initially run.
ELMER is capable of performing directory listings.
Empire includes various modules for finding files of interest on hosts and network shares.
Epic recursively searches for all .doc files on the system and collects a directory listing of the Desktop, %TEMP%, and %WINDOWS%\Temp directories.
FALLCHILL can search files on a victim.
FatDuke can enumerate directories on target machines.
It has used the Windows dir command to enumerate files and directories in a victim's network.
FinFisher enumerates directories and scans for certain files.
FIVEHANDS has the ability to enumerate files on a compromised host in order to encrypt files with specific extensions.
FLASHFLOOD searches for interesting files (either a default or customized set of file extensions) on the local system and removable media.
FoggyWeb's loader can check for the FoggyWeb backdoor .pri file on a compromised AD FS server.
Forfiles can be used to locate certain types of files/directories in a system.(ex: locate all files with a specific extension, name, and/or age)
It has used WizTree to obtain network files and directory listings.
FruitFly looks for specific files and file types.
FunnyDream can identify files with .doc, .docx, .ppt, .pptx, .xls, .xlsx, and .pdf extensions and specific timestamps for collection.
FYAnti can search the C:\Windows\Microsoft.NET\ directory for files of a specified size.
Fysbis has the ability to search for files.
It macros can scan for Microsoft Word and Excel files to inject with additional malicious macros. It has also used its backdoors to automatically list interesting files (such as Office documents) found on a system.
Gelsemium can retrieve data from specific Windows directories, as well as open random files as part of Virtualization/Sandbox Evasion.
GeminiDuke collects information from the victim, including installed drivers, programs previously executed by users, programs and services configured to automatically run at startup, files and folders present in any user's home folder, files and folders present in any user's My Documents, programs installed to the Program Files folder, and recently accessed files, folders, and programs.
Gold Dragon lists the directories for Desktop, program files, and the user’s recently accessed files.
GoldenSpy has included a program "ExeProtector", which monitors for the existence of GoldenSpy on the infected system and redownloads if necessary.
GravityRAT collects the volumes mapped on the system, and also steals files with the following extensions: .docx, .doc, .pptx, .ppt, .xlsx, .xls, .rtf, and .pdf.
GrimAgent has the ability to enumerate files and directories on a compromised host.
It has searched file contents on a compromised host.
HermeticWiper can enumerate common folders such as My Documents, Desktop, and AppData.
Heyoka Backdoor has the ability to search the compromised host for files.
HOPLIGHT has been observed enumerating system drives and partitions.
HotCroissant has the ability to retrieve a list of files in a given directory as well as drives and drive types.
HTTPBrowser is capable of listing files, folders, and drives on a victim.
Hydraq creates a backdoor through which remote attackers can check for the existence of files, including its own components, as well as retrieve a list of logical drives.
The IceApple Directory Lister module can list information about files and directories including creation time, last write time, name, and size.
Imminent Monitor has a dynamic debugging feature to check whether it is located in the %TEMP% directory, otherwise it copies itself there.
It used a file listing plugin to collect information about file and directories both on local and remote drives.
Industroyer’s data wiper component enumerates specific files on all the Windows drives.
InnaputRAT enumerates directories and obtains file attributes on a system.
InvisiMole can list information about files in a directory and recently opened or used documents. InvisiMole can also search for specific files by supplied file mask.
Ixeshe can list file and directory information.
JPIN can enumerate drives and their types. It can also change file permissions using cacls.exe.
jRAT can browse file systems.
Kasidet has the ability to search for a given filename on a victim.
Kazuar finds a specified directory, lists the files and metadata about those files.
It uses command-line interaction to search files and directories.
KeyBoy has a command to launch a file browser or explorer on the system.
KEYMARBLE has a command to search for files on the victim’s machine.
KGH_SPY can enumerate files and directories on a compromised host.
KillDisk has used the FindNextFile command as part of its file deletion process.
It has the ability to enumerate all files and directories on an infected system.
Kinsing has used the find command to search for specific files.
Kivars has the ability to list drives on the infected host.
Koadic can obtain a list of directories.
A version of KONNI searches for filenames created with a previous version of the malware, suggesting different versions targeted the same victims and the versions may work together.
Kwampirs collects a list of files and directories in C:\ with the command dir /s /a c:\ >> "C:\windows\TEMP[RANDOM].tmp".
It malware can use a common function to identify target files by their extension, and some also enumerate files and directories, including a Destover-like variant that lists files and gathers information for all drives.
It used a tool called MailSniper to search for files on the desktop and another utility called Sobolsoft to extract attachments from EML files.
Linfo creates a backdoor through which remote attackers can list contents of drives and search for files.
Lokibot can search for specific files on an infected host.
LookBack can retrieve file listings from the victim machine.
It has used malware that scans for files in the Documents, Desktop, and Download folders and in other drives.
It produces file listings in order to search for files to be exfiltrated.
MacMa can search for a specific file on the compromised computer and can enumerate files in Desktop, Downloads, and Documents folders.
Mafalda can search for files and directories.
It malware can list a victim's logical drives and the type, as well the total/free space of the fixed devices. Other malware can list a directory's contents.
MarkiRAT can look for files carrying specific extensions such as: .rtf, .doc, .docx, .xls, .xlsx, .ppt, .pptx, .pps, .ppsx, .txt, .gpg, .pkr, .kdbx, .key, and .jpb.
MegaCortex can parse the available drives and directories to determine which files to encrypt.
It has searched compromised systems for folders of interest including those related to HR, audit and expense, and meeting memos.
MESSAGETAP checks for the existence of two configuration files (keyword_parm.txt and parm.txt) and attempts to read the files every 30 seconds.
metaMain can recursively enumerate files in an operator-provided directory.
Metamorfo has searched the Program Files directories for specific folders and has searched for strings related to its mutexes.
Micropsia can perform a recursive directory listing for all volume drives available on the victim's machine and can also fetch specific files by their paths.
MiniDuke can enumerate local drives.
Misdat is capable of running commands to obtain a list of files and directories, as well as enumerating logical drives.
MobileOrder has a command to upload to its C2 server information about files on the victim mobile device, including SD card size, installed app list, SMS content, contacts, and calling history.
MoonWind has a command to return a directory listing for a specified directory.
It has used malware that checked if the ProgramData folder had folders or files with the keywords "Kasper," "Panda," or "ESET."
It has searched the entire target system for DOC, DOCX, PPT, PPTX, XLS, XLSX, and PDF files.
NDiskMonitor can obtain a list of all files and directories as well as logical drives.
Nebulae can list files and directories on a compromised host.
NETEAGLE allows adversaries to enumerate and modify the infected host's file system. It supports searching for directories, creating directories, listing directory contents, reading and writing to files, retrieving file attributes, and retrieving volume information.
NETWIRE has the ability to search for files on the compromised host.
During Night Dragon, threat actors used zwShell to establish full remote control of the connected machine and browse the victim file system.
NightClub can use a file monitor to identify .lnk, .doc, .docx, .xls, .xslx, and .pdf files.
njRAT can browse file systems using a file manager module.
NotPetya searches for files ending with dozens of different file extensions prior to encryption.
ObliqueRAT has the ability to recursively enumerate files on an infected endpoint.
OceanSalt can extract drive information from the endpoint and search files on the system.
Octopus can collect information on the Windows directory and searches for compressed RAR files on the host.
Okrum has used DriveLetterView to enumerate drive information.
During Operation CuckooBees, the threat actors used dir c:\\ to search for files.
During Operation Dream Job, It conducted word searches within documents on a compromised host in search of security and financial matters.
During Operation Honeybee, the threat actors used a malicious DLL to search for files with specific keywords.
During Operation Wocao, threat actors gathered a recursive directory listing to find files and directories of interest.
Orz can gather victim drive information.
OSX/Shlayer has used the command appDir="$(dirname $(dirname "$currentDir"))" and $(dirname "$(pwd -P)") to construct installation paths.
OutSteel can search for specific file extensions, including zipped files.
OwaAuth has a command to list its directory and logical drives.
P.A.S. Webshell has the ability to list files and file characteristics including extension, size, ownership, and permissions.
Pasam creates a backdoor through which remote attackers can retrieve lists of files.
A It payload has searched all fixed drives on the victim for files matching a specified list of extensions.
Penquin can use the command code do_vslist to send file names, size, and status to C2.
Peppy can identify specific files for exfiltration.
PinchDuke searches for files created within a certain timeframe and whose file extension matches a predefined list.
PingPull can enumerate storage volumes and folder contents of a compromised host.
Pisloader has commands to list drives on the victim machine and to list file information for a given directory.
PLEAD has the ability to list drives and files on the compromised host.
PlugX has a module to enumerate drives and find files recursively.
PoetRAT has the ability to list files upon receiving the ls command from C2.
POORAIM can conduct file browsing.
PoshC2 can enumerate files on the local file system and includes a module for enumerating recently accessed files.
PowerDuke has commands to get the current directory name as well as the size of a file. It also has commands to obtain information about logical drives, drive type, and free space.
POWRUNER may enumerate user directories on a victim.
Prestige can traverse the file system to discover files to encrypt by identifying specific extensions defined in a hardcoded list.
A module in Prikormka collects information about the paths, size, and creation time of files with specific file extensions, but not the actual content of the file.
Proxysvc lists files in directories.
Psylo has commands to enumerate all storage devices and to find all files that start with a particular string.
Pteranodon identifies files matching certain file extension and copies them to subdirectories it created.
Pupy can walk through directories and recursively search for strings in files.
QakBot can identify whether it has been run previously on a host by checking for a specified folder.
QuietSieve can search files on the target host by extension, including doc, docx, xls, rtf, odt, txt, jpg, pdf, rar, zip, and 7z.
RainyDay can use a file exfiltration tool to collect recently changed files with specific extensions.
Ramsay can collect directory and file lists.
RARSTONE obtains installer properties from Uninstall Registry Key entries to obtain information about installed applications and how to uninstall certain applications.
Rclone can list files and directories with the ls, lsd, and lsl commands.
RedLeaves can enumerate and search for files and directories.
Remcos can search for files on the infected machine.
Remexi searches for files on the system.
RemoteUtilities can enumerate files and directories on a target machine.
Remsec is capable of listing contents of folders on the victim. Remsec also searches for custom network encryption software on victims.
REvil has the ability to identify specific files and directories that are not to be encrypted.
Rising Sun can enumerate information about files from the infected system, including file size, attributes, creation time, last access time, and write time. Rising Sun can enumerate the compilation timestamp of Windows executable files.
ROKRAT has the ability to gather a list of files and directories on the infected system.
Rover automatically searches for files on local drives based on a predefined list of file extensions.
Royal can identify specific files and directories to exclude from the encryption process.
It can check for specific files and directories associated with virtualization and malware analysis.
Ryuk has enumerated files and folders on all mounted drives.
Saint Bot can search a compromised host for specific files.
It has enumerated files on a compromised host.
SDBbot has the ability to get directory listings or drive information on a compromised host.
Seasalt has the capability to identify the drive type on a victim.
SharpDisco can identify recently opened files by using an LNK format parser to extract the original file path from LNK files found in either %USERPROFILE%\Recent (Windows XP) or %APPDATA%\Microsoft\Windows\Recent (newer Windows versions) .
ShimRat can list directories.
SHOTPUT has a command to obtain a directory listing.
SideTwist has the ability to search for specific files.
It has used malware to collect information on files and directories.
SILENTTRINITY has several modules, such as ls.py, pwd.py, and recentFiles.py, to enumerate directories and files.
Siloscape searches for the Kubernetes config file and other related files using a regular expression.
Skidmap has checked for the existence of specific files including /usr/sbin/setenforce and  /etc/selinux/config. It also has the ability to monitor the cryptocurrency miner file and process.
Sliver can enumerate files on a target system.
SLOTHFULMEDIA can enumerate files and directories.
Smoke Loader recursively searches through directories for files.
During the SolarWinds Compromise, It obtained information about the configured Exchange virtual directory using Get-WebServicesVirtualDirectory.
SombRAT can execute enum to enumerate files in storage on a compromised system.
SoreFang has the ability to list directories.
SOUNDBITE is capable of enumerating and manipulating files and directories.
It identified and extracted all Word documents on a server by using a command containing * .doc and *.docx. The actors also searched for documents based on a specific date range and attempted to identify all installed software on a victim.
SPACESHIP identifies files and directories for collection by searching for specific file extensions or file modification time.
StreamEx has the ability to enumerate drive types.
StrifeWater can enumerate files on a compromised host.
StrongPity can parse the hard drive on a compromised host to identify specific file extensions.
Stuxnet uses a driver to scan for specific filesystem driver objects.
SUGARDUMP can search for and collect data from specific Chrome, Opera, Microsoft Edge, and Firefox files, including any folders that have the string Profile in its name.
SUNBURST had commands to enumerate files and directories.
SUNSPOT enumerated the Orion software Visual Studio solution directory path.
SynAck checks its directory location in an attempt to avoid launching in a sandbox.
SysUpdate can search files on a compromised host.
Taidoor can search for specific files.
TAINTEDSCRIBE can use DirectoryList to enumerate files in a specified directory.
TajMahal has the ability to index files from drives, user profiles, and removable drives.
It has used a script that checks /proc/*/environ for environment variables related to AWS.
ThreatNeedle can obtain file and directory information.
TINYTYPHON searches through the drive containing the OS, then all drive letters C through to Z, for documents matching certain extensions.
TrickBot searches the system for all of the following file extensions: .avi, .mov, .mkv, .mpeg, .mpeg4, .mp4, .mp3, .wav, .ogg, .jpeg, .jpg, .png, .bmp, .gif, .tiff, .ico, .xlsx, and .zip. It can also obtain browsing history, cookies, and plug-in information.
Trojan.Karagany can enumerate files and directories on a compromised host.
It has monitored files' modified time.
TSCookie has the ability to discover drive information on the infected host.
Turian can search for specific files and list directories.
It surveys a system upon check-in to discover files in specific locations on the hard disk %TEMP% directory, the current user's desktop, the Program Files directory, and Recent. It RPC backdoors have also searched for files matching the lPH*.dll pattern.
TYPEFRAME can search directories for files on the victim’s machine.
UPPERCUT has the capability to gather the victim's current directory.
Uroburos can search for specific files on a compromised system.
USBferry can detect the victim's file or folder list.
USBStealer searches victim drives for files matching certain extensions (".skr",".pkr" or ".key") or names.
Volgmer can list directories on a victim.
WannaCry searches for variety of user files by file extension before encrypting them using RSA and AES, including Office, PDF, image, audio, video, source code, archive/compression format, and key and certificate files.
WarzoneRAT can enumerate directories on a compromise host.
WastedLocker can enumerate files and directories just prior to encryption.
WhisperGate can locate files based on hardcoded file extensions.
It has used a script to check for the presence of files created by OpenSSH backdoors.
WindTail has the ability to enumerate the users home directory and the path to its own application bundle.
WINERACK can enumerate files and directories.
WinMM sets a WH_CBT Windows hook to search for and capture files on the victim.
Winnti for Windows can check for the presence of specific files prior to moving to the next phase of execution.
It has used a program named ff.exe to search for specific documents on compromised hosts.
Woody RAT can list all files and their associated attributes, including filename, type, owner, creation time, last access time, last write time, size, and permissions.
XAgentOSX contains the readFiles function to return a detailed listing (sometimes recursive) of a specified directory. XAgentOSX contains the showBackupIosFolder function to check for IOS device backups by running ls -la ~/Library/Application\ Support/MobileSync/Backup/.
XCSSET has used mdfind to enumerate a list of apps known to grant screen sharing permissions.
yty gathers information on victim’s drives and has a plugin for document listing.
Zebrocy searches for files that are 60mb and less and contain the following extensions: .doc, .docx, .xls, .xlsx, .ppt, .pptx, .exe, .zip, and .rar. Zebrocy also runs the echo %APPDATA% command to list the contents of the directory. Zebrocy can obtain the current execution path as well as perform drive enumeration.
Zeus Panda searches for specific directories on the victim’s machine.
ZLib has the ability to enumerate files and drives.
Zox can enumerate files on a compromised host.
zwShell can browse the file system.
ZxShell has a command to open a file manager and explorer on the system.