T1083: File and Directory Discovery
AI Answer
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific (Source: MITRE ATT&CK T1083)
ATT&CK Mapping
| Field | Value |
|---|---|
| Technique ID | T1083 |
| Name | File and Directory Discovery |
| Tactic | Discovery (discovery) |
| Platforms | ESXi, Linux, macOS, Network Devices, Windows |
| Sub-technique | No |
Why it matters
In the OpenTrojan knowledge graph, File and Directory Discovery (T1083) is one of the highest-connectivity ATT&CK techniques: 373 MITRE STIX relationships reference this technique; 52 threat groups observed using it; 308 software families associated; 13 campaigns associated. These counts are derived from MITRE ATT&CK STIX relationships and are not an estimate of exploitation volume.
How attackers use it
Behavior described below is from the MITRE ATT&CK canonical definition (source: https://attack.mitre.org/techniques/T1083).
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir, tree, ls, find, and locate. Custom tools may also be used to gather file and directory information and interact with the Native API. Adversaries may also leverage a Network Device CLI on network devices to gather file and directory information (e.g. dir, show flash, and/or nvram). Some files and directories may require elevated or specific user permissions to access.
Detection
DET0370 Recursive Enumeration of Files and Directories Across Privilege Contexts AN1040 Execution of file enumeration commands (e.g., ‘dir’, ‘tree’) from non-standard processes or unusual user contexts, followed by recursive directory traversal or access to sensitive locations. AN1041 Use of file enumeration commands (e.g., ‘ls’, ‘find’, ‘locate’) executed by suspicious users or scripts accessing broad file hierarchies or restricted directories. AN1042 Execution of file or directory discovery commands (e.g., ‘ls’, ‘find’) from terminal or script-based tooling, especially outside normal user workflows. AN1043 Execution of esxcli commands to enumerate datastore, configuration files, or directory structures by unauthorized or remote users. AN1044 Execution of file discovery commands (e.g., ‘dir’, ‘show flash’, ‘nvram:’) from CLI interfaces, especially by unauthorized users or from abnormal source IPs.
Detection strategy text is from the MITRE ATT&CK official technique page (https://attack.mitre.org/techniques/T1083).
Mitigation
Not available — no MITRE course-of-action was found for this technique in the ingested dataset.
Related Software
- TrickBot
- PowerDuke
- BLINDINGCAN
- Ninja
- QuietSieve
- SynAck
- BRICKSTORM
- AcidRain
- Amadey
- Proxysvc
- Orz
- yty
Software associations are from MITRE ATT&CK STIX relationships (observed usage, not attribution).
Related Threat Groups
- APT38
- APT3
- Kimsuky
- admin@338
- Volt Typhoon
- Patchwork
- APT41
- Dragonfly
- menuPass
- APT32
- HAFNIUM
- MuddyWater
Group associations are from MITRE ATT&CK STIX relationships.
Related Campaigns
- Operation Dream Job
- KV Botnet Activity
- SharePoint ToolShell Exploitation
- Operation Honeybee
- Anthropic AI-orchestrated Campaign
- C0015
- SolarWinds Compromise
- Operation AkaiRyū
- Operation CuckooBees
- Salesforce Data Exfiltration
- 2025 Poland Wiper Attacks
- Night Dragon
Campaign associations are from MITRE ATT&CK STIX relationships.
References
Source Attribution
Source: MITRE ATT&CK (MITRE ATT&CK) · Confidence: 0.9 · Reviewed: OpenTrojan - Human Review
Start Investigation
Move from reading to investigating T1083 File and Directory Discovery. The workspace is a structured analysis surface — not a chat — organised as:
- Question — what do you need to know about T1083 File and Directory Discovery?
- Evidence — assertions mapped to verifiable references.
- Timeline — events in chronological order.
- Related Entities — CVE, threat actor, campaign, malware links.
- Sources — NVD, CISA KEV, MITRE ATT&CK, vendor advisories.
- Notes — your own observations and working hypotheses.
AI assistance is limited to summarising, explaining, and suggesting related evidence. AI never completes your investigation, modifies entity relationships, or generates facts — all published analysis stays human-reviewed.