Use Of Hidden Paths Or Files

Title: Use Of Hidden Paths Or Files
Status: test
Description:Detects calls to hidden files or files located in hidden directories in NIX systems.
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
Author: David Burkett, @signalblur
Date: 2022-12-30
modified:None
Tags:

• -'attack.privilege-escalation'
• -'attack.persistence'
• -'attack.execution'
• -'attack.stealth'
• -'attack.t1574.001'

Logsource:

• product: linux
• service: auditd

Detection:
  selection:
    type: 'PATH'
    name|contains: '/.'
  filter:
    name|contains:
      -'/.cache/'
      -'/.config/'
      -'/.pyenv/'
      -'/.rustup/toolchains'

  condition:selection and not filter
Falsepositives:
  -Unknown
Level: low