Remote File Creation in World Writeable Directory

Last updated 2 months ago on 2025-11-12

Created 10 months ago on 2025-02-20

About

This rule detects the creation of a file in a world-writeable directory through a service that is commonly used for file transfer. This behavior is often associated with lateral movement and can be an indicator of an attacker attempting to move laterally within a network.

Tags

Domain: EndpointOS: LinuxUse Case: Threat DetectionTactic: Lateral MovementData Source: Elastic DefendLanguage: kuery

Severity

medium

Risk Score

MITRE ATT&CK™

Lateral Movement (TA0008)(external, opens in a new tab or window)

↳ Remote Services (T1021)(external, opens in a new tab or window)

↳ Lateral Tool Transfer (T1570)(external, opens in a new tab or window)

License

Elastic License v2(external, opens in a new tab or window)

Definition

Rule Type: New Terms Rule
Integration Pack: Prebuilt Security Detection Rules
Index Patterns: logs-endpoint.events.file*auditbeat-*
Related Integrations: endpoint(external, opens in a new tab or window)
Query

✄𐘗text code block:
✄𐘗event.category:file and host.os.type:linux and event.action:creation and
process.name:(ftp or rsync or scp or sftp or sftp-server or ssh or sshd or vsftpd) and
file.path:((/dev/shm/* or /tmp* or /var/tmp*) and not (/tmp/ansible-tmp-* or /var/tmp/ansible-tmp-*)) and
not user.id:0

Install detection rules in Elastic Security

Detect Remote File Creation in World Writeable Directory in the Elastic Security detection engine by installing this rule into your Elastic Stack.

To setup this rule, check out the installation guide for Prebuilt Security Detection Rules(external, opens in a new tab or window).