A subject may use their own abstracted file system, separate from the standard file system. In doing so, insiders can hide the presence of malicious components and file input/output from security tools.

MITRE ATT&CK® Mapping (2)

ATT&CK Enterprise Matrix Version 17.1

Anti-Forensics

Account Misuse

Clear Browser Artifacts

Clear Email Artifacts

Decrease Privileges

Delayed Execution Triggers

Delete User Account

Deletion of Volume Shadow Copy

Disk Wiping

File Deletion

File Encryption

Hide Artifacts

Hiding or Destroying Command History

Log Deletion

Log Modification

Modify Windows Registry

Network Obfuscation

Physical Destruction of Storage Media

Physical Removal of Disk Storage

Stalling

Steganography

System Shutdown

Timestomping

Tripwires

Uninstalling Software

Virtualization

Windows System Time Modification

Hidden File System

MITRE ATT&CK® Mapping (2)