Hidden Files and Directories

Title: Hidden Files and Directories
Status: test
Description:Detects adversary creating hidden file or directory, by detecting directories or files with . as the first character
References:
  -https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
Author: Pawel Mazur
Date: 2021-09-06
modified:2025-06-16
Tags:

• -'attack.stealth'
• -'attack.t1564.001'

Logsource:

• product: linux
• service: auditd

Detection:
  selection_commands:
    type: 'EXECVE'
    a0:
      -'mkdir'
      -'nano'
      -'touch'
      -'vi'
      -'vim'

  selection_arguments:
a1|re:'(^|\/)\.[^.\/]' a2|re:'(^|\/)\.[^.\/]'   condition:all of selection_*
Falsepositives:
  -Unknown
Level: low