File planting is the act of dropping a file in a location that later causes execution or another security-relevant action. The planted file may be a shortcut, script, configuration file, or executable placed where an application or the operating system will trust it and use it automatically. The key risk is not the write itself, but the follow-on behavior triggered by that write.
In cyber security, file planting matters because it can turn a limited write capability into persistence, privilege abuse, or delayed code execution. Attackers look for writable paths such as startup folders, plugin directories, search paths, or application data locations where a file will be loaded later. Defenders reduce the risk with strict path validation, least-privilege file access, sandboxing, and monitoring for unexpected writes in sensitive directories. A suspicious file created by an untrusted process is often an early sign of a planting attempt.