Threat intelligence / Technique

File and Directory Discovery

Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information. Examples include dir , tree , ls , find , and locate .(Citation: Windows Commands JPCERT) Custom tools may also be used to gather file and directory information and interact with the [Native API](https://attack.mitre.org/techniques/T1106). Adversaries may also leverage a [Network Device CLI](https://attack.mitre.org/techniques/T1059/008) on network devices to gather file and directory information (e.g. dir , show flash , and/or nvram ).(Citation: US-CERT-TA18-106A) Some files and directories may require elevated or specific user permissions to access.

Technique

TypeTechnique

External ID—

First seen2026-08-14

Last seen2026-08-14

Confidence

—

375 recorded

Relationships

mapped-to

from Directory Indexing

Technique

mapped-to

from File Discovery

Technique

uses

from 2025 Poland Wiper Attacks

Campaign

uses

from 3PARA RAT

Malware

uses

from 4H RAT

Malware

uses

from AcidPour

Malware

uses

from AcidRain

Malware

uses

from Action RAT

Malware

uses

from admin@338

Group

uses

from ADVSTORESHELL

Malware

uses

from Akira

Malware

uses

from Akira _v2

Malware

uses

from Amadey

Malware

uses

from ANELLDR

Malware

uses

from Anthropic AI-orchestrated Campaign

Campaign

uses

from Aoqin Dragon

Group

uses

from AppleSeed

Malware

uses

from APT18

Group

uses

from APT28

Group

uses

from APT3

Group

uses

from APT32

Group

uses

from APT38

Group

uses

from APT39

Group

uses

from APT41

Group

uses

from APT5

Group

uses

from Aria-body

Malware

uses

from AshTag

Malware

uses

from Attor

Malware

uses

from AuditCred

Malware

uses

from AutoIt backdoor

Malware

uses

from Avaddon

Malware

uses

from Avenger

Malware

uses

from AvosLocker

Malware

uses

from Azorult

Malware

uses

from Babuk

Malware

uses

from BabyShark

Malware

uses

from BackConfig

Malware

uses

from Backdoor.Oldrea

Malware

uses

from BACKSPACE

Malware

uses

from BADFLICK

Malware

uses

from BADNEWS

Malware

uses

from BadPatch

Malware

uses

from Bandook

Malware

uses

from Bankshot

Malware

uses

from Bazar

Malware

uses

from BBSRAT

Malware

uses

from BeaverTail

Malware

uses

from Bisonal

Malware

uses

from Black Basta

Malware

uses

from BlackCat

Malware

uses

from BLACKCOFFEE

Malware

uses

from BlackEnergy

Malware

uses

from BlackMould

Malware

uses

from BLINDINGCAN

Malware

uses

from BLUELIGHT

Malware

uses

from BOLDMOVE

Malware

uses

from BoomBox

Malware

uses

from BoxCaon

Malware

uses

from Brave Prince

Malware

uses

from BRICKSTORM

Malware

uses

from BRONZE BUTLER

Group

uses

from C0015

Campaign

uses

from CaddyWiper

Malware

uses

from CanisterWorm

Malware

uses

from Cannon

Malware

uses

from Cardinal RAT

Malware

uses

from Caterpillar WebShell

Malware

uses

from ccf32

Malware

uses

from CharmPower

Malware

uses

from ChChes

Malware

uses

from Cheerscrypt

Malware

uses

from Chimera

Group

uses

from CHIMNEYSWEEP

Malware

uses

from China Chopper

Malware

uses

from CHOPSTICK

Malware

uses

from Clambling

Malware

uses

from Clop

Malware

uses

from cmd

Tool

uses

from COATHANGER

Malware

uses

from Cobalt Strike

Malware

uses

from Confucius

Group

uses

from Contagious Interview

Group

uses

from Conti

Malware

uses

from CookieMiner

Malware

uses

from CORALDECK

Malware

uses

from CosmicDuke

Malware

uses

from CrackMapExec

Tool

uses

from CreepyDrive

Malware

uses

from Crimson

Malware

uses

from CrossRAT

Malware

uses

from Cryptoistic

Malware

uses

from Cuba

Malware

uses

from Cuckoo Stealer

Malware

uses

from Cyclops Blink

Malware

uses

from Dacls

Malware

uses

from Dark Caracal

Group

uses

from DarkGate

Malware

uses

from Darkhotel

Group

uses

from DarkWatchman

Malware

uses

from DDKONG

Malware

uses

from DEATHRANSOM

Malware

uses

from Denis

Malware

uses

from Derusbi

Malware

uses

from Diavol

Malware

uses

from Diskpart

Tool

uses

from Doki

Malware

uses

from down_new

Malware

uses

from Dragonfly

Group

uses

from DropBook

Malware

uses

from Dtrack

Malware

uses

from DUSTTRAP

Malware

uses

from DustySky

Malware

uses

from DynoWiper

Malware

uses

from Elise

Malware

uses

from ELMER

Malware

uses

from Embargo

Malware

uses

from Empire

Tool

uses

from Epic

Malware

uses

from Exbyte

Malware

uses

from FALLCHILL

Malware

uses

from FatDuke

Malware

uses

from FIN13

Group

uses

from FinFisher

Malware

uses

from FIVEHANDS

Malware

uses

from FLASHFLOOD

Malware

uses

from FoggyWeb

Malware

uses

from Forfiles

Tool

uses

from Fox Kitten

Group

uses

from FruitFly

Malware

uses

from FunnyDream

Malware

uses

from FYAnti

Malware

uses

from Fysbis

Malware

uses

from Gamaredon Group

Group

uses

from Gelsemium

Malware

uses

from GeminiDuke

Malware

uses

from Gold Dragon

Malware

uses

from GoldenSpy

Malware

uses

from Gomir

Malware

uses

from GravityRAT

Malware

uses

from GrimAgent

Malware

uses

from HAFNIUM

Group

uses

from Havoc

Malware

uses

from HermeticWiper

Malware

uses

from Heyoka Backdoor

Malware

uses

from HOPLIGHT

Malware

uses

from HotCroissant

Malware

uses

from HTTPBrowser

Malware

uses

from Hydraq

Malware

uses

from IceApple

Malware

uses

from Imminent Monitor

Tool

uses

from Inception

Group

uses

from INC Ransomware

Malware

uses

from Industroyer

Malware

uses

from InnaputRAT

Malware

uses

from InvisibleFerret

Malware

uses

from InvisiMole

Malware

uses

from Ixeshe

Malware

uses

from JPIN

Malware

uses

from jRAT

Malware

uses

from Kasidet

Malware

uses

from Kazuar

Malware

uses

from Ke3chang

Group

uses

from KeyBoy

Malware

uses

from KEYMARBLE

Malware

uses

from KGH_SPY

Malware

uses

from KillDisk

Malware

uses

from Kimsuky

Group

uses

from Kinsing

Malware

uses

from Kivars

Malware

uses

from Koadic

Tool

uses

from KONNI

Malware

uses

from KV Botnet Activity

Campaign

uses

from Kwampirs

Malware

uses

from LAMEHUG

Malware

uses

from Latrodectus

Malware

uses

from Lazarus Group

Group

uses

from LazyWiper

Malware

uses

from Leafminer

Group

uses

from LightSpy

Malware

uses

from Linfo

Malware

uses

from LITTLELAMB.WOOLTEA

Malware

uses

from LockBit 2.0

Malware

uses

from LockBit 3.0

Malware

uses

from LODEINFO

Malware

uses

from LoFiSe

Malware

uses

from Lokibot

Malware

uses

from LookBack

Malware

uses

from Lotus Blossom

Group

uses

from LuminousMoth

Group

uses

from LunarMail

Malware

uses

from LunarWeb

Malware

uses

from Machete

Malware

uses

from MacMa

Malware

uses

from Mafalda

Malware

uses

from Magic Hound

Group

uses

from Mango

Malware

uses

from Manjusaka

Malware

uses

from MarkiRAT

Malware

uses

from Medusa Group

Group

uses

from Medusa Ransomware

Malware

uses

from MegaCortex

Malware

uses

from Megazord

Malware

uses

from menuPass

Group

uses

from MESSAGETAP

Malware

uses

from metaMain

Malware

uses

from Metamorfo

Malware

uses

from Micropsia

Malware

uses

from MiniDuke

Malware

uses

from Mini Shai-Hulud

Malware

uses

from MirrorFace

Group

uses

from Misdat

Malware

uses

from Mispadu

Malware

uses

from MobileOrder

Malware

uses

from MoonWind

Malware

uses

from MuddyWater

Group

uses

from MultiLayer Wiper

Malware

uses

from Mustang Panda

Group

uses

from NDiskMonitor

Malware

uses

from Nebulae

Malware

uses

from NETEAGLE

Malware

uses

from NETWIRE

Malware

uses

from NightClub

Malware

uses

from Night Dragon

Campaign

uses

from Ninja

Malware

uses

from njRAT

Malware

uses

from NotPetya

Malware

uses

from ObliqueRAT

Malware

uses

from OceanSalt

Malware

uses

from Octopus

Malware

uses

from ODAgent

Malware

uses

from Okrum

Malware

uses

from Operation AkaiRyū

Campaign

uses

from Operation CuckooBees

Campaign

uses

from Operation Dream Job

Campaign

uses

from Operation Honeybee

Campaign

uses

from Operation Wocao

Campaign

uses

from Orz

Malware

uses

from OSX/Shlayer

Malware

uses

from OutSteel

Malware

uses

from OwaAuth

Malware

uses

from PACEMAKER

Malware

uses

from Pasam

Malware

uses

from P.A.S. Webshell

Malware

uses

from Patchwork

Group

uses

from Pcexter

Malware

uses

from Penquin

Malware

uses

from Peppy

Malware

uses

from PinchDuke

Malware

uses

from PingPull

Malware

uses

from Pisloader

Malware

uses

from Play

Group

uses

from Playcrypt

Malware

uses

from PLEAD

Malware

uses

from PlugX

Malware

uses

from PoetRAT

Malware

uses

from POORAIM

Malware

uses

from PoshC2

Tool

uses

from PowerDuke

Malware

uses

from POWRUNER

Malware

uses

from Prestige

Malware

uses

from Prikormka

Malware

uses

from Proxysvc

Malware

uses

from Psylo

Malware

uses

from Pteranodon

Malware

uses

from Pupy

Tool

uses

from QakBot

Malware

uses

from Qilin

Malware

uses

from QuietSieve

Malware

uses

from Raccoon Stealer

Malware

uses

from RainyDay

Malware

uses

from Ramsay

Malware

uses

from RansomHub

Malware

uses

from RARSTONE

Malware

uses

from Raspberry Robin

Malware

uses

from Rclone

Tool

uses

from RedCurl

Group

uses

from RedLeaves

Malware

uses

from Remcos

Tool

uses

from Remexi

Malware

uses

from RemoteUtilities

Tool

uses

from Remsec

Malware

uses

from REvil

Malware

uses

from Rising Sun

Malware

uses

from ROADSWEEP

Malware

uses

from ROKRAT

Malware

uses

from Rover

Malware

uses

from Royal

Malware

uses

from RTM

Malware

uses

from Ryuk

Malware

uses

from Saint Bot

Malware

uses

from Salesforce Data Exfiltration

Campaign

uses

from SameCoin

Malware

uses

from Samurai

Malware

uses

from Sandworm Team

Group

uses

from Scattered Spider

Group

uses

from SDBbot

Malware

uses

from Seasalt

Malware

uses

from SharePoint ToolShell Exploitation

Campaign

uses

from SharpDisco

Malware

uses

from ShimRat

Malware

uses

from ShinyHunters

Group

uses

from SHOTPUT

Malware

uses

from SideTwist

Malware

uses

from Sidewinder

Group

uses

from SILENTTRINITY

Tool

uses

from Siloscape

Malware

uses

from Skidmap

Malware

uses

from Sliver

Tool

uses

from SLOTHFULMEDIA

Malware

uses

from Smoke Loader

Malware

uses

from SolarWinds Compromise

Campaign

uses

from SombRAT

Malware

uses

from SoreFang

Malware

uses

from SOUNDBITE

Malware

uses

from Sowbug

Group

uses

from SPACESHIP

Malware

uses

from Spica

Malware

uses

from SplatCloak

Malware

uses

from StealBit

Malware

uses

from StreamEx

Malware

uses

from StrifeWater

Malware

uses

from StrongPity

Malware

uses

from Stuxnet

Malware

uses

from SUGARDUMP

Malware

uses

from SUNBURST

Malware

uses

from SUNSPOT

Malware

uses

from SynAck

Malware

uses

from SysUpdate

Malware

uses

from Taidoor

Malware

uses

from TAINTEDSCRIBE

Malware

uses

from TajMahal

Malware

uses

from TeamPCP Cloud Stealer

Malware

uses

from TeamTNT

Group

uses

from ThreatNeedle

Malware

uses

from TINYTYPHON

Malware

uses

from ToddyCat

Group

uses

from TrickBot

Malware

uses

from Trojan.Karagany

Malware

uses

from Troll Stealer

Malware

uses

from Tropic Trooper

Group

uses

from TruffleHog

Tool

uses

from TSCookie

Malware

uses

from Turian

Malware

uses

from Turla

Group

uses

from TYPEFRAME

Malware

uses

from UNC3886

Group

uses

from UPPERCUT

Malware

uses

from Uroburos

Malware

uses

from USBferry

Malware

uses

from USBStealer

Malware

uses

from Velvet Ant

Group

uses

from Volgmer

Malware

uses

from Volt Typhoon

Group

uses

from WannaCry

Malware

uses

from WarzoneRAT

Malware

uses

from WastedLocker

Malware

uses

from WhisperGate

Malware

uses

from Windigo

Group

uses

from WindTail

Malware

uses

from WINERACK

Malware

uses

from WinMM

Malware

uses

from Winnti for Windows

Malware

uses

from Winnti Group

Group

uses

from Winter Vivern

Group

uses

from Woody RAT

Malware

uses

from XAgentOSX

Malware

uses

from XCSSET

Malware

uses

from yty

Malware

uses

from Zebrocy

Malware

uses

from Zeus Panda

Malware

uses

from ZIPLINE

Malware

uses

from ZLib

Malware

uses

from Zox

Malware

uses

from zwShell

Malware

uses

from ZxShell

Malware

3 external

References

mitre-attack

T1083

open

Windows Commands JPCERT

https://blogs.jpcert.or.jp/en/2016/01/windows-commands-abused-by-attackers.html

open

US-CERT-TA18-106A

https://www.us-cert.gov/ncas/alerts/TA18-106A

open