Skip to content
THE HUNTER’S LEDGER
ATT&CK Technique · Discovery
T1083 File and Directory Discovery
Mapped by 9 reports, 0 detection rules and 4 tracked actors on The Hunters Ledger. Technique page on attack.mitre.org.

← All techniques and the coverage heatmap

Reports

Each report maps this technique in its own ATT&CK table, at the confidence the report states. The link opens that table.

Report Jul 2026 · under Discovery · HIGH
EvilSoul-Engine: A Brazilian Stealer-Builder Malware-as-a-Service
Report May 2026 · under Discovery · HIGH
CVE-2026-41940 cPanel Harvester Toolkit (216.126.227.49)
Report Apr 2026 · under Discovery · HIGH
AdaptixC2 Open Directory Exposure (45.130.148.125)
Report Apr 2026 · under Discovery · HIGH
OpenStrike Expanded Toolkit — 106 New Files (2026-04-08)
Report Apr 2026 · under Discovery · DEFINITE
OpenStrike Beacon Toolkit (172.105.0.126)
Report Feb 2026 · under Discovery · HIGH
Remcos RAT OpenDirectory Campaign
Report Jan 2026 · under Discovery · HIGH
Arsenal-237 New Files: Advanced Toolkit Analysis

Detection rules

No published detection rule on the site covers this technique yet.

Tracked actors

Designations whose reports map this technique.

  • UTA-2026-004: Developer of the OpenStrike multi-implant C2 toolkit, with a cracked Cobalt Strike arsenal
  • UTA-2026-006: Stock AdaptixC2 operator with an operator-written PowerShell and .NET injection chain
  • UTA-2026-007: HijackLoader customer running a 15-month multi-vector phishing campaign into an AsyncRAT-class RAT
  • UTA-2026-011: Financially motivated operator weaponising a cPanel authentication bypass with a custom harvesting toolkit

ATT&CK v19.2. MITRE ATT&CK® is a registered trademark of The MITRE Corporation; technique names are MITRE's and link to MITRE's own pages. The mapping on each linked page is this publication's reading of its own evidence.