Threat actors may attempt to hide artifacts associated with their behaviors to evade detection. Operating systems may have features to hide various artifacts, such as important system files and administrative task execution, to avoid disrupting user work environments and prevent users from changing files or features on the system. Threat actors may abuse these features to hide artifacts such as files, directories, user accounts, or other system activity to evade detection.
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.