host-interaction/file-system/files/list

enumerate files recursively

rule:
  meta:
    name: enumerate files recursively
    namespace: host-interaction/file-system/files/list
    authors:
      - "@_re_fox"
      - anushka.virgaonkar@mandiant.com
    scopes:
      static: function
      dynamic: unsupported
    att&ck:
      - Discovery::File and Directory Discovery [T1083]
    mbc:
      - Discovery::File and Directory Discovery [E1083]
    examples:
      - 5f66b82558ca92e54e77f216ef4c066c:0x40640E
  features:
    - and:
      - or:
        - match: enumerate files on Windows
        - match: enumerate files on Linux
      - characteristic: recursive call

last edited: 2024-04-23 11:49:05