File and Directory Discovery

What is File and Directory Discovery?

“File and Directory Discovery is documented as technique T1083 in MITRE ATT&CK® v19.1 under the Discovery tactic. Detection requires visibility into XDR, SIEM telemetry.”

Detection Strategies

The following detection strategies help SOC analysts identify File and Directory Discovery activity. These methods apply across XDR, SIEM environments and can be implemented as detection rules, correlation queries, or behavioral analytics in your security platform.

1. 1

   Monitor for file system enumeration commands particularly those searching for file types commonly associated with credentials and sensitive data such as *.kdbx, *.pfx, *.key, id_rsa, *.config, and *.rdp files.

2. 2

   Alert on processes accessing large numbers of files in quick succession, particularly across multiple directories, as this pattern is consistent with automated file search operations rather than normal user activity.

3. 3

   Detect searches targeting specific sensitive directories including backup locations, certificate stores, SSH key directories, and application configuration paths that are not normally accessed by standard user processes.

4. 4

   Monitor for PowerShell Get-ChildItem or Select-String commands searching for specific keywords like password, credential, secret, or token within file contents, which indicates targeted credential harvesting.

5. 5

   Track access to network shares by monitoring SMB access logs, alerting on accounts accessing shares outside of their normal job function or accessing large numbers of files across multiple share locations rapidly.

Example Alerts

These realistic alert examples show what File and Directory Discovery looks like in your security tools. Use them to tune detection rules and train analysts to recognize true positives versus false positives in live environments.

Frequently Asked Questions

How do SOC analysts detect File and Directory Discovery?

Detection centers on XDR, SIEM telemetry for the discovery phase of the attack. Monitor for file system enumeration commands particularly those searching for file types commonly associated with credentials and sensitive data such as *.kdbx, *.pfx, *.key, id_rsa, *.config, and *.rdp files. Alert on processes accessing large numbers of files in quick succession, particularly across multiple directories, as this pattern is consistent with automated file search operations rather than normal user activity.

What does a File and Directory Discovery alert look like?

A representative XDR detection is "Recursive Search for Credential Files" (high severity): PowerShell command executed: Get-ChildItem -Recurse -Include *.kdbx,*.pfx,*.p12,id_rsa,*.pem -Path C:\ and \\FILESERVER\. This targeted search for certificate files, private keys, and password manager databases is consistent with post-compromise credential harvesting. The process has subsequently enumerated and copied 14 matching files to a staging directory.

Which tools detect File and Directory Discovery, and how can I practice?

File and Directory Discovery (T1083) is best surfaced with XDR, SIEM telemetry, which exposes the discovery signals described above. Practice detecting it on those exact consoles in SOCSimulator Operations, free.