Linux auditd: Hidden file or directory creation via dot-prefixed paths

title: "Linux auditd: Hidden file or directory creation via dot-prefixed paths"
id: e935715b-ac5e-409c-96a4-e948a4cc2f66
status: test
description: This rule flags process executions of mkdir, nano, touch, vi, or vim where the arguments include a path component starting with a dot (hidden file/directory pattern). Adversaries use dot-prefixed names to hide files and configuration or staging artifacts from casual inspection. The detection relies on Linux auditd EXECVE telemetry, specifically the command and argument fields matched against dot-prefixed path regular expressions.
references:
  - https://github.com/redcanaryco/atomic-red-team/blob/f339e7da7d05f6057fdfcdd3742bfcf365fee2a9/atomics/T1564.001/T1564.001.md
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/execve/lnx_auditd_hidden_files_directories.yml
author: Pawel Mazur, Huntrule Team
date: 2021-09-06
modified: 2025-06-16
tags:
  - attack.stealth
  - attack.t1564.001
logsource:
  product: linux
  service: auditd
detection:
  selection_commands:
    type: EXECVE
    a0:
      - mkdir
      - nano
      - touch
      - vi
      - vim
  selection_arguments:
    - a1|re: (^|\/)\.[^.\/]
    - a2|re: (^|\/)\.[^.\/]
  condition: all of selection_*
falsepositives:
  - Unknown
level: low
license: DRL-1.1
related:
  - id: d08722cd-3d09-449a-80b4-83ea2d9d4616
    type: derived