Use Of Hidden Paths Or Files In Linux

SigmaHQ Detections@sigmaHQ

•updated Oct 23, 2025•4•1•44

Detects calls to hidden files or files located in hidden directories in Linux systems. This rule specifically looks for file paths containing '/.' which is a common convention for hidden files and directories in Unix-like systems, while filtering out common legitimate hidden paths like '.cache' and '.config'.