Linux auditd: Access to hidden files or hidden directories (/. paths)

Alerts when Linux auditd shows PATH values referencing hidden files or hidden directories (excluding common dev/cache paths).

FreeReviewedSigma · Low · v3

Product: linux
Service: auditd
Author: David Burkett, @signalblur (SigmaHQ), DRL 1.1
Published: 2022-12-30
Updated: 2026-07-31

Analysis Detection

ATT&CK techniques

Execution → Defense Evasion

Recon
Resource Dev
Initial Access
Execution
- T1574.001DLL
Persistence
- T1574.001DLL
Priv Esc
- T1574.001DLL
Defense Evasion
- T1574.001DLL
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule flags process activity where the event field 'name' contains a path component beginning with '/.' (hidden file or directory) on Linux auditd logs. Attackers often use hidden paths to reduce visibility during execution, persistence, or privilege-escalation staging. The detection relies on auditd telemetry that records PATH entries and matches paths containing '/.' while excluding common developer/runtime directories such as /.cache/, /.config/, /.pyenv/, and /.rustup/toolchains.

Reporting behind it

Related detections9 linkedT1574.001 — drag to rearrange

Suspicious DLL Sideloading via msdtc oci.dll Install (via process_creation)

Suspicious wmicodegen.dll Sideload by inetinfo.exe (UAT-8099 Cobalt Strike)

Suspicious LucidRook DismCore.dll Side-Load into Browser Process

Suspicious Encrypted Implant File Creation for DLL Search Order Hijacking (RainyDay Turian PlugX)

Suspicious RoboForm Signed Binary Executed From Non-Standard Path (via process_creation)

Malicious dal_keepalives.dll Sideloaded By Signed Binary (via image_load)

Suspicious Cortex XDR Binary Sideloading winutils.dll (via image_load)

Suspicious CoinLoader DLL Sideload From Z-1-36-81 Directory (via image_load)

Suspicious shfolder.dll Sideloading via VMware net-service Binary

Linux auditd: Access to hidden files or hidden directories (/. paths)

Pivot detection · T1574.001 · 9 related

Changelog

v3
Candidate ingested via manual entry.2026-07-31
v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-auditd-executable-command-path-containing-hidden-files-or-hidden-directori-9e1bef8d

title: "Linux auditd: Access to hidden files or hidden directories (/. paths)"
id: ac7896f0-ddba-4eef-91a8-87da0837324a
related:
  - id: d08722cd-3d09-449a-80b4-83ea2d9d4616
    type: similar
  - id: 9e1bef8d-0fff-46f6-8465-9aa54e128c1e
    type: derived
status: test
description: This rule flags process activity where the event field 'name' contains a path component beginning with '/.' (hidden file or directory) on Linux auditd logs. Attackers often use hidden paths to reduce visibility during execution, persistence, or privilege-escalation staging. The detection relies on auditd telemetry that records PATH entries and matches paths containing '/.' while excluding common developer/runtime directories such as /.cache/, /.config/, /.pyenv/, and /.rustup/toolchains.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/path/lnx_auditd_hidden_binary_execution.yml
author: David Burkett, @signalblur, Huntrule Team
date: 2022-12-30
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.execution
  - attack.stealth
  - attack.t1574.001
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: PATH
    name|contains: /.
  filter:
    name|contains:
      - /.cache/
      - /.config/
      - /.pyenv/
      - /.rustup/toolchains
  condition: selection and not filter
falsepositives:
  - Unknown
level: low
license: DRL-1.1

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL