T1083 — File and Directory Discovery

# T1083 - File and Directory Discovery

## SOC Recommendation
Investigate File and Directory Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.

## D3FEND Mappings
| D3FEND Technique | Relationship | Practical SOC Action |
|---|---|---|
| File Analysis | Detect | Monitor for File Analysis indicators relevant to this technique. |
| File Encryption | Harden | Apply File Encryption to reduce this technique's viability before an incident occurs. |
| File Eviction | Evict | Use File Eviction to remove the adversary's foothold once this technique is confirmed. |
| Local File Permissions | Isolate | Apply Local File Permissions to contain the blast radius once this technique is observed. |

## Investigation Steps
1. Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.
2. Check Sentinel analytics rules and incidents correlated with this technique.
3. Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource.

## Evidence to Collect
- Host or resource affected
- Account or identity involved
- Timestamp of the activity
- Related process, file, or network artifact
- Any preceding or follow-on alerts

## Response Actions
| Action | Risk | Automation Safe | Approval Required |
|---|---|---|---|
| If enumeration on a workstation (not a management server): i | Low | No | Yes |
| Review share permissions — are sensitive shares accessible t | Low | Yes | No |

## KQL
```kql
AWSCloudTrail
| where EventName == "DescribeImageScanFindings" and isempty(ErrorCode) and isempty(ErrorMessage)
| extend repoName = tostring(parse_json(ResponseElements).repositoryName)
| extend imageId = tostring(parse_json(ResponseElements).imageId.imageDigest)
| extend Critical = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.CRITICAL)
| extend High = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.HIGH)
| where Critical > 0 or High > 0
| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)
| extend UserName = tostring(split(UserIdentityArn, '/')[-1])
| extend AccountName = case( UserIdentityPrincipalid == "Anonymous", "Anonymous", isempty(UserIdentityUserName), UserName, UserIdentityUserName)
| extend AccountName = iif(AccountName contains "@", tostring(split(AccountName, '@', 0)[0]), AccountName),
  AccountUPNSuffix = iif(AccountName contains "@", tostring(split(AccountName, '@', 1)[0]), "")
```
```kql
Netclean_Incidents_CL |  where value_incidentVersion_d == 1
```
```kql
let discoveryRecords = FortyTwoCrunchAPIProtection
| where TimeGenerated >= ago(5m) 
| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid 
| where Status == 404 and ErrorMessage startswith "path not defined in OAS";
let discoveryCnt = (toscalar(discoveryRecords | count));
let recCount = iff((discoveryCnt > 500), 1, 0);
discoveryRecords | top recCount by Timestamp desc
```

## Escalation Criteria
- File and Directory Discovery activity observed on a privileged account or critical system.
- Activity follows or precedes other suspicious behaviour in the same investigation.
- Automated triage cannot confidently rule out malicious intent.

## False Positive Considerations
- Legitimate administrative or maintenance activity matching this pattern.
- Approved security testing or red team exercise.
- Known benign software producing similar telemetry.

Generated by SOC Response Atlas by Basyrix.

Want to push this directly to Confluence? Upgrade to Basyrix Pro.

• /api/techniques/T1083.json
• /api/recommendations/T1083.json
• /api/d3fend/T1083.json
• /api/mappings/T1083.json
• /api/confluence/T1083.md

Example curl:

curl https://atlas.basyrix.com/api/recommendations/T1083.json

Response:

{
  "technique_id": "T1083",
  "name": "File and Directory Discovery",
  "priority": "medium",
  "status": "complete",
  "version": "0.1.0",
  "last_reviewed": "2026-07-23",
  "generated_by": "SOC Response Atlas by Basyrix",
  "tactics": [
    "Discovery"
  ],
  "platforms": [
    "ESXi",
    "Linux",
    "macOS",
    "Network Devices",
    "Windows"
  ],
  "summary": "Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from [File and Directory Discovery](https://attack.mitre.org/techniques/T1083) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command shell utilities can be used to obtain this information...",
  "soc_recommendation": "Investigate File and Directory Discovery activity in the context of Discovery: confirm scope, affected host/identity, and whether it matches expected administrative behaviour before deciding this is benign.",
  "d3fend_mappings": [
    {
      "id": "D3-FA",
      "name": "File Analysis",
      "relationship": "detect",
      "practical_action": "Monitor for File Analysis indicators relevant to this technique.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FE",
      "name": "File Encryption",
      "relationship": "harden",
      "practical_action": "Apply File Encryption to reduce this technique's viability before an incident occurs.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-FEV",
      "name": "File Eviction",
      "relationship": "evict",
      "practical_action": "Use File Eviction to remove the adversary's foothold once this technique is confirmed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    },
    {
      "id": "D3-LFP",
      "name": "Local File Permissions",
      "relationship": "isolate",
      "practical_action": "Apply Local File Permissions to contain the blast radius once this technique is observed.",
      "tooling": [
        "Defender for Endpoint"
      ]
    }
  ],
  "investigation_steps": {
    "microsoft": [
      "Review Defender for Endpoint / Defender XDR alerts and timeline for the affected host or identity.",
      "Check Sentinel analytics rules and incidents correlated with this technique.",
      "Review Entra ID sign-in and audit logs if the technique involves an identity or cloud resource."
    ],
    "generic": [
      "Confirm whether the observed file and directory discovery activity matches expected administrative or application behaviour.",
      "Identify the host, account, or resource where the activity occurred and its business criticality.",
      "Check for related alerts before and after this activity to reconstruct the broader intrusion timeline.",
      "Real detection reference: \"AWSCloudTrail - ECR image scan findings high or critical\" -- Identifies Amazon ECR image scan findings that report high or critical severity vulnerabilities. These findings indicate container images that should be reviewed and remediated before deployment or continued use."
    ]
  },
  "evidence_to_collect": [
    "Host or resource affected",
    "Account or identity involved",
    "Timestamp of the activity",
    "Related process, file, or network artifact",
    "Any preceding or follow-on alerts"
  ],
  "response_actions": [
    {
      "name": "If enumeration on a workstation (not a management server): i",
      "category": "Response",
      "risk": "Low",
      "automation_safe": false,
      "approval_required": true,
      "tool": "See investigation guide",
      "notes": "If enumeration on a workstation (not a management server): investigate as compromised host"
    },
    {
      "name": "Review share permissions — are sensitive shares accessible t",
      "category": "Response",
      "risk": "Low",
      "automation_safe": true,
      "approval_required": false,
      "tool": "See investigation guide",
      "notes": "Review share permissions — are sensitive shares accessible to all domain users?"
    }
  ],
  "queries": {
    "kql": [
      {
        "name": "f6928301-56da-4d2c-aabe-e1a552bc8892 — AWSCloudTrail - ECR image scan findings high or critical",
        "description": "Identifies Amazon ECR image scan findings that report high or critical severity vulnerabilities. These findings indicate container images that should be reviewed and remediated before deployment or continued use. (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "AWSCloudTrail\n| where EventName == \"DescribeImageScanFindings\" and isempty(ErrorCode) and isempty(ErrorMessage)\n| extend repoName = tostring(parse_json(ResponseElements).repositoryName)\n| extend imageId = tostring(parse_json(ResponseElements).imageId.imageDigest)\n| extend Critical = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.CRITICAL)\n| extend High = toint(parse_json(ResponseElements).imageScanFindings.findingSeverityCounts.HIGH)\n| where Critical > 0 or High > 0\n| extend UserIdentityArn = iif(isempty(UserIdentityArn), tostring(parse_json(Resources)[0].ARN), UserIdentityArn)\n| extend UserName = tostring(split(UserIdentityArn, '/')[-1])\n| extend AccountName = case( UserIdentityPrincipalid == \"Anonymous\", \"Anonymous\", isempty(UserIdentityUserName), UserName, UserIdentityUserName)\n| extend AccountName = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 0)[0]), AccountName),\n  AccountUPNSuffix = iif(AccountName contains \"@\", tostring(split(AccountName, '@', 1)[0]), \"\")"
      },
      {
        "name": "77548170-5c60-42e5-bdac-b0360d0779bb — NetClean ProActive Incidents",
        "description": "NetClean Incident' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "Netclean_Incidents_CL |  where value_incidentVersion_d == 1"
      },
      {
        "name": "421b38ec-4295-4aed-8299-c92e268ad663 — API - Kiterunner detection",
        "description": "42Crunch API protection against Kiterunner enumeration' (Source: Microsoft's official Azure-Sentinel Detections (MIT licensed).)",
        "query": "let discoveryRecords = FortyTwoCrunchAPIProtection\n| where TimeGenerated >= ago(5m) \n| project-away NonBlockingMode, SourcePort, DestinationPort, Query, ApiId, RequestHeader, ResponseHeader, Errors, EventType, Uuid \n| where Status == 404 and ErrorMessage startswith \"path not defined in OAS\";\nlet discoveryCnt = (toscalar(discoveryRecords | count));\nlet recCount = iff((discoveryCnt > 500), 1, 0);\ndiscoveryRecords | top recCount by Timestamp desc"
      }
    ],
    "spl": [],
    "esql": [
      {
        "name": "b8e4c2a1-7f3d-4e9b-8c5a-1d0e6f2a4b8c — Potential Credential Discovery via Recursive Grep",
        "description": "(ESQL) Identifies recursive grep activity on Linux or macOS where the command line suggests hunting for secrets, credentials, keys, tokens, or sensitive paths (for example .env, .git, .aws)... (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from logs-endpoint.events.process-* metadata _id, _version, _index\n| where host.os.type in (\"linux\", \"macos\")\n  and event.category == \"process\"\n  and process.name in (\"grep\", \"egrep\")\n  and (to_lower(process.command_line) like \"* -r*\" or to_lower(process.command_line) like \"*--recursive*\")\n  and (\n    process.command_line like \"*password*\"\n    or process.command_line like \"*passwd*\"\n    or process.command_line like \"*pwd*\"\n    or process.command_line like \"*secret*\"\n    or process.command_line like \"*token*\"\n    or process.command_line like \"*apikey*\"\n    or process.command_line like \"*api_key*\"\n    or process.command_line like \"*api.key*\"\n    or process.command_line like \"*access_key*\"\n    or process.command_line like \"*private_key*\"\n    or process.command_line like \"*client_secret*\"\n    or process.command_line like \"*credential*\"\n    or process.command_line like \"*auth*\"\n    or process.command_line like \"*bearer*\"\n    or process.command_line like \"*BEGIN*PRIVATE*KEY*\"\n    or process.command_line like \"*ssh-rsa*\"\n    or process.command_line like \"*ghp_*\"\n    or process.command_line like \"*github_pat*\"\n    or process.command_line like \"*xoxb-*\"\n    or process.command_line like \"*hooks.slack.com*\"\n    or process.command_line like \"*discord.com/api/webhooks*\"\n    or process.command_line like \"*/.aws/*\"\n    or process.command_line like \"*/.git/*\"\n    or process.command_line like \"*/.env*\"\n  )\n  and (process.parent.command_line is null or not (to_lower(process.parent.command_line) like \"*shell-snapshots*\" and process.parent.name in (\"bash\", \"sh\", \"zsh\")))\n| eval Esql.time_bucket = date_trunc(1 minute, @timestamp)\n| stats Esql.unique_cmd = count_distinct(process.command_line),\n        Esql.cmd_values = values(process.command_line),\n        Esql.pcmd_values = values(process.parent.command_line)\n  by process.name, host.id, host.name, agent.id, process.parent.name, user.name, Esql.time_bucket\n| where Esql.unique_cmd >= 3\n| keep host.id, host.name, agent.id, user.name, process.parent.name, Esql.*"
      },
      {
        "name": "90e4ceab-79a5-4f8e-879b-513cac7fcad9 — Web Server Local File Inclusion Activity",
        "description": "(ESQL) This rule detects potential Local File Inclusion (LFI) activity on web servers by identifying HTTP GET requests that attempt to access sensitive local files through directory traversal techniques or known file paths. Attackers may exploit LFI vulnerabilities to read sensitive files, gain system information, or further compromise the server. (Source: Elastic's official detection-rules repository (Elastic License v2).)",
        "query": "from\n  logs-nginx.access-*,\n  logs-apache.access-*,\n  logs-apache_tomcat.access-*,\n  logs-iis.access-*,\n  logs-traefik.access-*\n| where\n    http.request.method == \"GET\" and\n    http.response.status_code == 200 and\n    url.original like \"*=*\"\n\n| eval Esql.url_original_url_decoded_to_lower = to_lower(URL_DECODE(url.original))\n\n| where\n  /* 1) Relative traversal */\n    Esql.url_original_url_decoded_to_lower like \"*../../../../*\" or           // Unix-style traversal\n    Esql.url_original_url_decoded_to_lower like \"*..\\\\\\\\..\\\\\\\\..\\\\\\\\..*\" or           // Windows-style traversal\n    // Potential security check bypassing (enforcing multiple dots and shortening the pattern)\n    Esql.url_original_url_decoded_to_lower like \"*..././*\" or\n    Esql.url_original_url_decoded_to_lower like \"*...\\\\*\" or\n    Esql.url_original_url_decoded_to_lower like \"*....\\\\*\" or\n\n  /* 2) Linux system identity / basic info */\n    Esql.url_original_url_decoded_to_lower like \"*etc/passwd*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/shadow*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/hosts*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/os-release*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/issue*\" or\n\n  /* 3) Linux /proc enumeration */\n    Esql.url_original_url_decoded_to_lower like \"*proc/self/environ*\" or\n    Esql.url_original_url_decoded_to_lower like \"*proc/self/cmdline*\" or\n    Esql.url_original_url_decoded_to_lower like \"*proc/self/fd*\" or\n    Esql.url_original_url_decoded_to_lower like \"*proc/self/exe*\" or\n\n  /* 4) Linux webroots, configs & logs */\n    Esql.url_original_url_decoded_to_lower like \"*var/www*\" or               // generic webroot\n    Esql.url_original_url_decoded_to_lower like \"*wp-config.php*\" or         // classic WP config\n    Esql.url_original_url_decoded_to_lower like \"*etc/apache2*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/httpd*\" or\n    Esql.url_original_url_decoded_to_lower like \"*etc/nginx*\" or\n    Esql.url_original_url_decoded_to_lower like \"*var/log/apache2*\" or\n    Esql.url_original_url_decoded_to_lower like \"*var/log/httpd*\" or\n    Esql.url_original_url_decoded_to_lower like \"*var/log/nginx*\" or\n\n  /* 5) Windows core files / identity */\n    Esql.url_original_url_decoded_to_lower like \"*windows/panther/*unattend*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/debug/netsetup.log*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/win.ini*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/system32/drivers/etc/hosts*\" or\n    Esql.url_original_url_decoded_to_lower like \"*boot.ini*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/system32/config/*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/repair/sam*\" or\n    Esql.url_original_url_decoded_to_lower like \"*windows/system32/license.rtf*\" or\n\n  /* 6) Windows IIS / .NET configs, webroots & logs */\n     Esql.url_original_url_decoded_to_lower like \"*/inetpub/wwwroot*\" or\n     Esql.url_original_url_decoded_to_lower like \"*/inetpub/logs/logfiles*\" or\n     Esql.url_original_url_decoded_to_lower like \"*applicationhost.config*\" or\n     Esql.url_original_url_decoded_to_lower like \"*/microsoft.net/framework64/*/config/web.config*\" or\n     Esql.url_original_url_decoded_to_lower like \"*windows/system32/inetsrv/*\" or\n\n  /* 7) PHP & protocol wrappers */\n     Esql.url_original_url_decoded_to_lower like \"*php://*\" or\n     Esql.url_original_url_decoded_to_lower like \"*zip://*\" or\n     Esql.url_original_url_decoded_to_lower like \"*phar://*\" or\n     Esql.url_original_url_decoded_to_lower like \"*expect://*\" or\n     Esql.url_original_url_decoded_to_lower like \"*file://*\" or\n     Esql.url_original_url_decoded_to_lower like \"*data://text/plain;base64*\"\n\n| keep\n    @timestamp,\n    Esql.url_original_url_decoded_to_lower,\n    source.ip,\n    agent.id,\n    agent.name,\n    http.request.method,\n    http.response.status_code,\n    data_stream.dataset,\n    data_stream.namespace\n\n| stats\n    Esql.event_count = count(),\n    Esql.url_original_url_decoded_to_lower_count_distinct = count_distinct(Esql.url_original_url_decoded_to_lower),\n    Esql.agent_name_values = values(agent.name),\n    Esql.agent_id_values = values(agent.id),\n    Esql.http_request_method_values = values(http.request.method),\n    Esql.http_response_status_code_values = values(http.response.status_code),\n    Esql.url_original_url_decoded_to_lower_values = values(Esql.url_original_url_decoded_to_lower),\n    Esql.data_stream_dataset_values = values(data_stream.dataset),\n    Esql.data_stream_namespace_values = values(data_stream.namespace)\n    by source.ip"
      }
    ]
  },
  "automation": {
    "safe": [
      "Add recommendation as Sentinel incident comment.",
      "Run enrichment queries.",
      "Create ServiceNow SecOps task."
    ],
    "approval_required": [
      "Contain or disable the affected host/account.",
      "Any change to production configuration."
    ]
  },
  "escalation_criteria": [
    "File and Directory Discovery activity observed on a privileged account or critical system.",
    "Activity follows or precedes other suspicious behaviour in the same investigation.",
    "Automated triage cannot confidently rule out malicious intent."
  ],
  "false_positive_considerations": [
    "Legitimate administrative or maintenance activity matching this pattern.",
    "Approved security testing or red team exercise.",
    "Known benign software producing similar telemetry."
  ],
  "confluence": {
    "title": "T1083 - File and Directory Discovery Response Guidance",
    "labels": [
      "mitre",
      "attack",
      "d3fend",
      "secops",
      "basyrix"
    ],
    "sections": [
      "summary",
      "d3fend_mappings",
      "investigation_steps",
      "response_actions",
      "queries",
      "automation",
      "escalation_criteria",
      "false_positive_considerations"
    ]
  }
}