[red team] att & CK - file hiding

Technical background

After the red team personnel obtain the server permission , A series of post infiltration operations will be carried out , There will be a back door 、 Have 、 Record the landing of documents, etc , If you want to keep the target machine for a long time without being found , It is bound to hide files .

Not just in the red blue confrontation , Many malicious Trojan viruses also perform file hiding operations , Some common executable files that communicate with remote control services often hide themselves , In order to avoid killing soft investigation .

Technical realization

Common method

At the beginning of the study , I've seen too many popular articles about creating hidden files , I would like to call it “ A gentleman realizes ” The way .

The implementation method is