File operations are actions performed on files, such as reading their contents, creating or changing them, and deleting them. Operating systems and applications use these actions for ordinary tasks, but they can also expose or alter sensitive data.
In cyber security, unauthorized file operations can help an attacker access information, plant tools, or remove logs and other evidence. For example, a flaw in a remote-support appliance might allow file access or deletion. Defenders monitor file activity, restrict permissions, and preserve relevant logs and artifacts when investigating suspected tampering.