Linux Hidden File or Directory Creation
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
Sigma
