T1083Discovery
File and Directory Discovery
Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions. Many command…
CVEs12
In CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it.10
Reports2
Detections
24 Sigma rules tagged T1083File and Directory DiscoveryT108324 general rules
- Turla Group Lateral Movementcriticaltest
- WannaCry Ransomware Activitycriticaltest
- HackTool - PCHunter Executionhightest
- PUA - Seatbelt Executionhightest
- Shell Execution GCC - Linuxhightest
- Shell Execution via Find - Linuxhightest
- Shell Execution via Flock - Linuxhightest
- Shell Execution via Nice - Linuxhightest
Sigma rules © SigmaHQ, Detection Rule License 1.1; linked, not reproduced.
CVEs linked to File and Directory Discovery
12 CVEs, by priority. Each link shows its badge.- CVE-2019-11510Ivanti Pulse Connect Secure Arbitrary File Read VulnerabilityIvanti · Pulse Connect SecureKEVRansomwarePublic exploitCritical · 10.0T1133External Remote ServicesT1059Command and Scripting Interpreter+2 more · 6 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%90.0priority
- CVE-2019-19781Citrix ADC, Gateway, and SD-WAN WANOP Appliance Code Execution VulnerabilityCitrix · Application Delivery Controller (ADC), Gateway, and SD-WAN WANOP ApplianceKEVRansomwarePublic exploitCritical · 9.8T1133External Remote ServicesT1059Command and Scripting Interpreter+1 more · 8 reportsMITRE CTID mapping of the KEV entry · follow-on activity>99.9%Top 0.01%89.9priority
- CVE-2024-53704SonicWall SonicOS SSLVPN Improper Authentication VulnerabilitySonicWall · SonicOSKEVRansomwarePublic exploitCritical · 9.8T1199Trusted RelationshipT1078.004Cloud Accounts+2 moreMITRE CTID mapping of the KEV entry · primary impact95.3%Top 0.13%79.8priority
- CVE-2023-28461Array Networks AG and vxAG ArrayOS Missing Authentication for Critical Function VulnerabilityArray Networks · AG/vxAG ArrayOSKEVRansomwareCritical · 9.8T1190Exploit Public-Facing ApplicationT1059Command and Scripting Interpreter+1 more · 1 reportAI mapping from the description · primary impact68.1%Top 0.68%78.6priority
- CVE-2023-22952Multiple SugarCRM Products Remote Code Execution VulnerabilitySugarCRM · Multiple ProductsKEVPublic exploitHigh · 8.8T1190Exploit Public-Facing ApplicationT1078Valid Accounts+7 moreMITRE CTID mapping of the KEV entry · follow-on activity80.1%Top 0.38%69.1priority
- CVE-2017-12637SAP NetWeaver Directory Traversal VulnerabilitySAP · NetWeaverKEVPublic exploitHigh · 7.5T1592Gather Victim Host InformationT1190Exploit Public-Facing Application+2 moreMITRE CTID mapping of the KEV entry · primary impact95.1%Top 0.14%68.2priority
- CVE-2019-7483SonicWall SMA100 Directory Traversal VulnerabilitySonicWall · SMA100KEVHigh · 7.5T1190Exploit Public-Facing ApplicationT1083File and Directory DiscoveryAI mapping from the description · primary impact4.0%Top 9.5%61.4priority
- CVE-2016-3298Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityMicrosoft · Internet ExplorerKEVEnd of lifeMedium · 6.5T1189Drive-by CompromiseT1083File and Directory DiscoveryMITRE CTID mapping of the CVE · uncategorised33.3%Top 1.6%57.2priority
- CVE-2019-0676Microsoft Internet Explorer Information Disclosure VulnerabilityMicrosoft · Internet ExplorerKEVEnd of lifeMedium · 6.5T1189Drive-by CompromiseT1083File and Directory DiscoveryAI mapping from the description · primary impact8.1%Top 5.2%46.5priority
- CVE-2016-0162Microsoft Internet Explorer Information Disclosure VulnerabilityMicrosoft · Internet ExplorerKEVEnd of lifeMedium · 4.3T1189Drive-by CompromiseT1083File and Directory DiscoveryAI mapping from the description · primary impact21.9%Top 2.3%45.5priority
- CVE-2008-6508Directory traversal vulnerability in the AuthCheck filter in the Admin Console in Openfire 3.6.0a and earlier allows…AI mapping from the description · primary impact83.7%Top 0.31%29.9priority
- CVE-2018-10590In Advantech WebAccess versions V8.2_20170817 and prior, WebAccess versions V8.3.0 and prior, WebAccess Dashboard…MITRE CTID mapping of the CVE · primary impact1.6%Top 24%15.2priority
Passages that support these links
CVE-2019-19781 enabled the actors to execute directory traversal attacks.