Hidden File System
Subtechnique · ATTACK:enterprise:T1564.005
Attributed source ↗ · Plaintext record · Complete record and assertions JSON
Inspect structured metadata and provenance
{
"id": "ATTACK:enterprise:T1564.005",
"title": "Hidden File System",
"type": "Subtechnique",
"source_url": "https://attack.mitre.org/techniques/T1564/005",
"snapshot": "enterprise-attack-20.0.json",
"status": "active",
"rights": "Source metadata only; source notices retained; no operational prose or payloads",
"review_status": "machine-extracted; source-specific checks passed, editorial review pending",
"stix_id": "attack-pattern--dfebc3b7-d19d-450b-81c7-6dafe4184c04",
"external_id": "T1564.005",
"domain": "enterprise",
"created": "2020-06-28T22:55:55.719Z",
"modified": "2026-05-12T15:12:00.722Z",
"version": "2.0",
"aliases": [
],
"tactics": [
"stealth"
],
"source_references": [
{
"source_name": "FireEye Bootkits",
"url": "https://www.fireeye.com/blog/threat-research/2015/12/fin1-targets-boot-record.html"
},
{
"source_name": "ESET ComRAT May 2020",
"url": "https://www.welivesecurity.com/wp-content/uploads/2020/05/ESET_Turla_ComRAT.pdf"
},
{
"source_name": "MalwareTech VFS Nov 2014",
"url": "https://www.malwaretech.com/2014/11/virtual-file-systems-for-beginners.html"
},
{
"source_name": "Kaspersky Equation QA",
"url": "https://media.kasperskycontenthub.com/wp-content/uploads/sites/43/2018/03/08064459/Equation_group_questions_and_answers.pdf"
}
]
}Explicit source assertions (7)
First 80 shown here; the complete set is in this record’s JSON and plaintext. Each relationship retains its source and locator. No inferred relationships are added.
ATTACK:enterprise:G0020 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--00caa57d-7b0f-4156-907e-18d14d62965a
Kaspersky Equation QAATTACK:enterprise:S0126 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--150e1b1c-a575-4542-a66e-c1646212744b
ESET ComRAT May 2020ATTACK:enterprise:S0019 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--223b8d4b-97e9-4581-91aa-a599fb787309
Kaspersky ReginATTACK:enterprise:S0114 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--29a6afc7-f051-4c26-b6a2-cad09c73180f
FireEye BootkitsATTACK:enterprise:S0022 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--561afb90-e94a-410f-9e6f-6880d996799f
Joint Cybersecurity Advisory AA23-129A Snake Malware May 2023ATTACK:enterprise:G0041 → uses → ATTACK:enterprise:T1564.005
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--d24a47e5-e735-4cad-9c44-09d3a39d514c
Kaspersky ProjectSauron Full ReportATTACK:enterprise:T1564.005 → subtechnique-of → ATTACK:enterprise:T1564
MITRE ATT&CK: Source assertion; no new actor identity, alias equivalence, CVE exploitation or causal inference. Procedure prose omitted.
Assertion source · Locator: relationship--e398ecb9-1e98-4518-aff8-aa18f527f9dc