Hidden Artifact Created on Remote Host via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•2

This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.