ListPlanting

How ListPlanting Works

ListPlanting is an abuse of trust in directory listings. An attacker places a file where users, operators, or applications expect only legitimate content, then relies on that file blending into the normal listing flow so it is overlooked, clicked, opened, or processed.

The technique is effective because many workflows assume that a directory listing reflects approved content. If write access is broader than intended, or if a tool treats “newly observed” files as harmless, the planted object can become an entry point for payload delivery, deceptive naming, or execution chains.

Why It Is Dangerous

The danger is not limited to the file itself. A planted file can masquerade as a benign document, script, shortcut, or asset, which can mislead review, trigger unsafe execution, or interfere with decision-making during incident response and content validation.

ListPlanting also turns ordinary directory visibility into a security boundary. When users trust filenames, ordering, icons, extensions, or directory position too much, an attacker can exploit that expectation to create confusion or hide malicious material in plain sight.

Exposure and Detection

Exposure usually begins with weak write controls on shared locations, uploads, sync folders, staging directories, or any path that is commonly enumerated by people or automation. The risk grows when directory contents are consumed by scripts, scheduled jobs, or review processes without validating origin, ownership, and expected naming patterns.

Detection should focus on change visibility as much as file content. Alerting on unexpected new files, suspicious filenames, unusual extensions, or sudden changes in directories that are normally stable can reveal list-based planting before the object is used. MITRE ATT&CK Guide for Defenders is useful here because ListPlanting aligns with ATT&CK techniques that abuse file and directory discovery, masquerading, and related execution paths.

Prevention and Review Practices

Prevention starts with restricting who can create files in directories that are listed, trusted, or operationally sensitive. Just as important, organisations should validate directory contents against expected inventory and reject assumptions based solely on appearance, filename, or location.

When review or automation depends on a directory listing, the process should treat newly added files as untrusted until provenance is confirmed. That includes checking ownership, path, extension, and whether the file belongs in that location at all. MITRE ATT&CK Enterprise Matrix helps defenders map those review gaps to the broader tactics attackers use after planting deceptive files.

Risk and Threat Considerations

ListPlanting is risky because it abuses the gap between “visible” and “trusted.” A file can be harmless in isolation yet still become dangerous when a human reviewer or application assumes that anything present in the directory is legitimate, expected, or safe to process.

Failure mechanism: The attacker gains influence over a directory that is later listed, scanned, opened, or executed, then leverages trust in the listing to disguise payloads or steer the victim toward unsafe action.

Impact: This can lead to payload execution, review bypass, malicious content staging, or delayed detection of compromise, especially where directory contents are used as an implicit approval signal.

Practitioner Guidance

What to watch for: Treat any directory that is both writable and routinely reviewed as a high-value control point. Unexpected new filenames, suspicious duplicates, or objects that do not match the directory’s normal purpose should be investigated as potential planting attempts.

Governance implication: Ownership of listed directories should be explicit, with clear rules for who may write, what naming is permitted, and how exceptions are reviewed. NIST SP 800-53 Rev 5 Security and Privacy Controls is relevant because access control, configuration management, auditability, and integrity controls all support preventing and detecting this abuse.