File descriptor enumeration is the practice of discovering which files, sockets or pipes a process has open by inspecting its descriptor table. Attackers use it to bypass blind path guessing and locate sensitive files that the application can already access, including configs, sockets and hidden data sources.
What File Descriptor Enumeration Reveals
File descriptor enumeration is a runtime inspection technique that shows which resources a process has already opened. Instead of guessing paths blindly, an attacker can identify live files, sockets, pipes, and other descriptors that may expose secrets, internal services, or sensitive data flows.
The practical value of the technique is that it turns the process itself into an information source. If an application can read a configuration file, talk to an internal socket, or keep a privileged handle open, descriptor enumeration may expose that access path even when the filesystem layout is unknown or partially hidden.
How the Technique Works
Every process maintains a descriptor table that maps small integer handles to underlying kernel resources. On Unix-like systems, these handles commonly appear as file entries, sockets, pipes, event descriptors, or deleted-but-still-open files. Enumeration inspects that table and then correlates the handles back to meaningful targets.
That correlation is what makes the technique useful. A descriptor pointing to a log file, a UNIX domain socket, or a mounted secret file can reveal more than a directory listing would. It can also show what the process can reach through inherited handles, which is often broader than what an unprivileged attacker could discover through path probing alone.
Why It Matters for Security
Descriptor enumeration often exposes the difference between what a process should access and what it actually has open at runtime. That can surface unintended reach into configuration files, IPC endpoints, temporary files, or data sources that were meant to stay internal to the application boundary.
It is especially useful after partial compromise, where an attacker has code execution but not a complete understanding of the environment. If a process has already opened something valuable, the attacker may not need directory traversal or path discovery at all. The open descriptor becomes the shortcut to sensitive material or privileged communication channels.
Common Places It Shows Up
In practice, descriptor enumeration matters wherever applications rely on long-lived handles or inherited resources. That includes services that keep secrets in memory-backed files, daemons that communicate over local sockets, workloads that inherit descriptors across forks, and applications that hold open files after access checks are complete.
It is also relevant when troubleshooting and incident response overlap. A descriptor table can explain why a process still has access to a deleted file, why a socket is reachable, or why a service seems to hold a resource that no longer exists on disk. For defenders, that makes it both an attack primitive and a diagnostic signal.
Risk and Threat Considerations
Descriptor enumeration becomes dangerous when a process already holds access to sensitive material, because the attacker can pivot from path discovery to live resources that the application has legitimately opened. That can expose secrets, local service interfaces, or hidden data sources without needing broader filesystem visibility.
Failure mechanism: The weakness is not the descriptor table itself, but the trust placed in whatever the process has open at runtime. If privileged files, deleted-but-open artifacts, or sensitive IPC endpoints remain attached to the process, enumeration can reveal them even when pathname-based controls appear intact.
Impact: The result can be secret disclosure, unauthorized access to internal services, or a faster path to privilege escalation and lateral movement after initial compromise.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
MITRE ATT&CK addresses the attack and risk surface, while NIST SP 800-53 Rev 5 and CIS Controls v8 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| MITRE ATT&CK | T1083 — File and Directory Discovery | Descriptor enumeration is a process-centered discovery step that reveals accessible files and resources. |
| Recommendation — Map observed descriptor reconnaissance to file and directory discovery and investigate what sensitive resources the process can already open. | ||
| NIST SP 800-53 Rev 5 | AU-2 — Event Logging | Open-descriptor inspection is often validated through process and access logging. |
| AC-6 — Least Privilege | Enumeration is most damaging when processes hold more open resources than they need. | |
| SC-7 — Boundary Protection | Open local sockets and inter-process channels are part of the attack surface descriptor enumeration exposes. | |
| Recommendation — Log process access and resource-opening events so descriptor-based reconnaissance leaves reviewable traces. Reduce the number of sensitive files, sockets, and handles a process can keep open. Segment and restrict local service channels so exposed descriptors do not reveal high-value internal interfaces. | ||
| CIS Controls v8 | CIS-5 — Account Management | Descriptor exposure commonly reflects excessive runtime access granted to the process identity. |
| Recommendation — Tighten process and service access so applications retain only the resources they require. | ||
Practitioner Guidance
What to watch for: Treat unexpected open descriptors as a security signal, not just an operational detail. Long-lived handles to secrets, local sockets, or deleted files often indicate that access is persisting beyond the moment it was needed.
Governance implication: Review which processes are allowed to retain sensitive descriptors and make descriptor hygiene part of hardening, logging, and incident triage. In practice, the goal is to reduce what an attacker can learn from a process that has already been breached.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Free weekly newsletter
Subscribe to the NHI & AI Identity Journal
The latest on NHI and Agentic AI security – articles, research, breaches, news and events every week.
Bonus 33% off our NHI Course when you subscribe.
Reviewed and updated by the NHIMG editorial team on October 12, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org