dirDevil: Hiding Code and Content Within Folder Structures
ID: b7f482d1-6332-57cd-a883-f47adb69d272
STIX ID: report--b7f482d1-6332-57cd-a883-f47adb69d272
Feed Name: TrustedSec blog
Threat Score
This post demonstrates a proof-of-concept method for hiding data in directory structures by encoding payloads as hexadecimal segments formatted into GUID-like folder names and reconstructing them with PowerShell. It explains chunking, indexing, padding, path-length limits, encoder/decoder scripts, and evaluates pros/cons including AV/EDR evasion potential, compression overhead, and practical limitations, concluding the technique is interesting but of limited real-world utility.
Your team is not currently subscribed to this feed. You must subscribe to it in order to see this post.
