# T1083 - File and Directory Discovery

## Description from ATT&CK

> Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
> 
> Many command shell utilities can be used to obtain this information. Examples include <code>dir</code>, <code>tree</code>, <code>ls</code>, <code>find</code>, and <code>locate</code>.(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. <code>dir</code>, <code>show flash</code>, and/or <code>nvram</code>).(Citation: US-CERT-TA18-106A)
> 
> Some files and directories may require elevated or specific user permissions to access.

[Source](https://attack.mitre.org/techniques/T1083)

## Atomic Tests

- [Atomic Test #1: File and Directory Discovery (cmd.exe)](#atomic-test-1-file-and-directory-discovery-cmdexe)
- [Atomic Test #2: File and Directory Discovery (PowerShell)](#atomic-test-2-file-and-directory-discovery-powershell)
- [Atomic Test #3: Nix File and Directory Discovery](#atomic-test-3-nix-file-and-directory-discovery)
- [Atomic Test #4: Nix File and Directory Discovery 2](#atomic-test-4-nix-file-and-directory-discovery-2)
- [Atomic Test #5: Simulating MAZE Directory Enumeration](#atomic-test-5-simulating-maze-directory-enumeration)
- [Atomic Test #6: Launch DirLister Executable](#atomic-test-6-launch-dirlister-executable)
- [Atomic Test #7: ESXi - Enumerate VMDKs available on an ESXi Host](#atomic-test-7-esxi---enumerate-vmdks-available-on-an-esxi-host)
- [Atomic Test #8: Identifying Network Shares - Linux](#atomic-test-8-identifying-network-shares---linux)
- [Atomic Test #9: Recursive Enumerate Files And Directories By Powershell](#atomic-test-9-recursive-enumerate-files-and-directories-by-powershell)

### Atomic Test #1: File and Directory Discovery (cmd.exe)

Find or discover files on the file system.  Upon successful execution, this test will output the results of all the data discovery commands to a specified file.

**Supported Platforms:** Windows

**auto_generated_guid:** `0e36303b-6762-4500-b003-127743b80ba6`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | File to output results to | string | %temp%&#92;T1083Test1.txt|

#### Attack Commands: Run with `command_prompt`!

```cmd
dir /s c:\ >> #{output_file}
dir /s "c:\Documents and Settings" >> #{output_file}
dir /s "c:\Program Files\" >> #{output_file}
dir "%systemdrive%\Users\*.*" >> #{output_file}
dir "%userprofile%\AppData\Roaming\Microsoft\Windows\Recent\*.*" >> #{output_file}
dir "%userprofile%\Desktop\*.*" >> #{output_file}
tree /F >> #{output_file}
```

#### Cleanup Commands

```cmd
del #{output_file}
```
### Atomic Test #2: File and Directory Discovery (PowerShell)

Find or discover files on the file system. Upon execution, file and folder information will be displayed.

**Supported Platforms:** Windows

**auto_generated_guid:** `2158908e-b7ef-4c21-8a83-3ce4dd05a924`

#### Attack Commands: Run with `powershell`!

```powershell
ls -recurse
get-childitem -recurse
gci -recurse
```

### Atomic Test #3: Nix File and Directory Discovery

Find or discover files on the file system

References:

http://osxdaily.com/2013/01/29/list-all-files-subdirectory-contents-recursively/

https://perishablepress.com/list-files-folders-recursively-terminal/

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `ffc8b249-372a-4b74-adcd-e4c0430842de`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file used to store the results. | path | /tmp/T1083.txt|

#### Attack Commands: Run with `sh`!

```sh
ls -a >> #{output_file}
if [ -d /Library/Preferences/ ]; then ls -la /Library/Preferences/ > #{output_file}; fi;
file */* *>> #{output_file}
cat #{output_file} 2>/dev/null
find . -type f
ls -R | grep ":$" | sed -e 's/:$//' -e 's/[^-][^\/]*\//--/g' -e 's/^/ /' -e 's/-/|/'
locate *
which sh
```

#### Cleanup Commands

```sh
rm #{output_file}
```
### Atomic Test #4: Nix File and Directory Discovery 2

Find or discover files on the file system

**Supported Platforms:** Linux, macOS

**auto_generated_guid:** `13c5e1ae-605b-46c4-a79f-db28c77ff24e`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| output_file | Output file used to store the results. | path | /tmp/T1083.txt|

#### Attack Commands: Run with `sh`!

```sh
cd $HOME && find . -print | sed -e 's;[^/]*/;|__;g;s;__|; |;g' > #{output_file}
if [ -f /etc/mtab ]; then cat /etc/mtab >> #{output_file}; fi;
find . -type f -iname *.pdf >> #{output_file}
cat #{output_file}
find . -type f -name ".*"
```

#### Cleanup Commands

```sh
rm #{output_file}
```
### Atomic Test #5: Simulating MAZE Directory Enumeration

This test emulates MAZE ransomware's ability to enumerate directories using Powershell.
Upon successful execution, this test will output the directory enumeration results to a specified file, as well as display them in the active window.
See https://www.mandiant.com/resources/tactics-techniques-procedures-associated-with-maze-ransomware-incidents

**Supported Platforms:** Windows

**auto_generated_guid:** `c6c34f61-1c3e-40fb-8a58-d017d88286d8`

#### Inputs

| Name | Description | Type | Default Value |
|------|-------------|------|---------------|
| File_to_output | File to output results to | string | $env:temp&#92;T1083Test5.txt|

#### Attack Commands: Run with `powershell`!

```powershell
$folderarray = @("Desktop", "Downloads", "Documents", "AppData/Local", "AppData/Roaming")
Get-ChildItem -Path $env:homedrive -ErrorAction SilentlyContinue | Out-File -append #{File_to_output}
Get-ChildItem -Path $env:programfiles -erroraction silentlycontinue | Out-File -append #{File_to_output}
Get-ChildItem -Path "${env:ProgramFiles(x86)}" -erroraction silentlycontinue | Out-File -append #{File_to_output}
$UsersFolder = "$env:homedrive\Users\"
foreach ($directory in Get-ChildItem -Path $UsersFolder -ErrorAction SilentlyContinue)
{
foreach ($secondarydirectory in $folderarray)
 {Get-ChildItem -Path "$UsersFolder/$directory/$secondarydirectory" -ErrorAction SilentlyContinue | Out-File -append #{File_to_output}}
}
cat #{File_to_output}
```

#### Cleanup Commands

```powershell
remove-item #{File_to_output} -ErrorAction SilentlyContinue
```
### Atomic Test #6: Launch DirLister Executable

Launch