Hidden File Created with Dot Prefix via SSH

Darshan Thummar@Mighty

•updated Jun 11, 2026•0•0•5

This rule detects the creation of hidden files or directories (those prefixed with a dot) over an SSH connection. Specifically, it looks for the 'mkdir .' string within TCP traffic on port 22, indicating an attempt to create a hidden directory. This technique is often used by attackers for defense evasion to conceal malicious files or activities.