Techniques › T1564.001 › AN0092
AN0092 Analytic 0092
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Creation of files or directories with a leading '.' in privileged directories (/etc, /var, /usr/bin). Defender view: monitoring auditd logs for file creations where name begins with '.' and correlated with unusual user/process context.</p>
- Detects
- T1564.001 Hidden Files and Directories
- Part of
- DET0032 Detection Strategy for Hidden Files and Directories
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:FILE | File creation with name starting with '.' | DC0039 File Creation |
| auditd:EXECVE | Use of mv or cp to rename files with '.' prefix | DC0064 Command Execution |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
DirectoryScope | Restrict detection to critical directories to avoid noise from benign hidden files like .ssh or .config. |