Create Hidden Files or Directories

Description

Detecting hidden files or directories creation can serve as an auditing rule to track general system changes. Such rules can be noisy and challenging to interpret, particularly if your system frequently undergoes updates. However, careful profiling of your environment can transform this rule into an effective rule for detecting unusual behavior associated with system changes, including compliance-related cases.

Query · falco

((modify and evt.arg.newpath contains "/.") or
 (mkdir and evt.arg.path contains "/.") or
 (open_write and evt.arg.flags contains "O_CREAT" and fd.name contains "/." and not fd.name pmatch (exclude_hidden_directories)))
and not user_known_create_hidden_file_activities and not exe_running_docker_save

Rule dependencies

Depends on

  • composes · Falco macro exe_running_docker_save
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro mkdir
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro modify
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro open_write
    A shared condition, not a detection — not indexed on this site.
  • composes · Falco macro user_known_create_hidden_file_activities
    A shared condition, not a detection — not indexed on this site.

Analyst notes

Hidden file or directory created | file=%fd.name newpath=%evt.arg.newpath evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline terminal=%proc.tty

Raw source Create Hidden Files or Directories · Falco YAML
Esc
Published by falcosecurity/rules ↗, licensed under Apache 2.0 ↗. Reproduced here unmodified. 
rule: Create Hidden Files or Directories
desc: 'Detecting hidden files or directories creation can serve as an auditing rule
  to track general system changes. Such rules can be noisy and challenging to interpret,
  particularly if your system frequently undergoes updates. However, careful profiling
  of your environment can transform this rule into an effective rule for detecting
  unusual behavior associated with system changes, including compliance-related cases.

  '
condition: "((modify and evt.arg.newpath contains \"/.\") or\n (mkdir and evt.arg.path\
  \ contains \"/.\") or\n (open_write and evt.arg.flags contains \"O_CREAT\" and fd.name\
  \ contains \"/.\" and not fd.name pmatch (exclude_hidden_directories)))\nand not\
  \ user_known_create_hidden_file_activities and not exe_running_docker_save\n"
enabled: false
output: Hidden file or directory created | file=%fd.name newpath=%evt.arg.newpath
  evt_type=%evt.type user=%user.name user_uid=%user.uid user_loginuid=%user.loginuid
  process=%proc.name proc_exepath=%proc.exepath parent=%proc.pname command=%proc.cmdline
  terminal=%proc.tty
priority: NOTICE
tags:
- maturity_sandbox
- host
- container
- filesystem
- mitre_defense_evasion
- T1564.001

Detection rules belong to the projects that publish them and remain under their own licenses. This site indexes and links to them; it claims no rights in them.