Look for hidden directories

[tclahr]

Discussed in #67

^{Originally posted by halpomeranz July 2, 2022}
Outside of user home directories, directory names starting with "." are uncommon. But we'll often see attackers staging tools in directories like "/tmp/.ICEd-unix". How about adding a check to list hidden directories that are not in user profile directories?

find / -path /root -prune -o -path /home/\* -prune -o -type d -name .\* -print

[tclahr]

Added an artifact that will list both hidden files and directories outside home dirs.

live_response/system/hidden_files_directories.yaml

Available in the develop branch.