Linux auditd: Executable/command PATH containing hidden files or hidden directories

title: "Linux auditd: Executable/command PATH containing hidden files or hidden directories"
id: ac7896f0-ddba-4eef-91a8-87da0837324a
related:
  - id: d08722cd-3d09-449a-80b4-83ea2d9d4616
    type: similar
  - id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e
    type: derived
status: test
description: This rule flags auditd events where the process PATH includes hidden entries in NIX/Linux environments, specifically paths containing '/.' while excluding common development and cache directories. Attackers use hidden files and directories to evade casual inspection, persist, or stage execution without drawing attention. The detection relies on auditd telemetry fields that capture the PATH value and applies substring matching to identify hidden components.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_hidden_binary_execution.yml
author: David Burkett, @signalblur, Huntrule Team
date: 2022-12-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name|contains: /.
  filter:
    name|contains:
      - /.cache/
      - /.config/
      - /.pyenv/
      - /.rustup/toolchains
  condition: selection and not filter
falsepositives:
  - Unknown
level: low
license: DRL-1.1