Loop device created or file loop-mounted as a filesystem

1title: Loop device created or file loop-mounted as a filesystem2id: 5ea14faf-680d-49d0-a15f-5a5a1172f2f93status: experimental4description: |5  Matches the Linux leg of AN1272: an EXECVE record for `losetup`, or for6  `mount` carrying a `loop` option, either of which is the concrete mechanism7  behind the technique's core claim — a filesystem stored inside a regular8  file rather than a disk partition, so that standard file-system tools never9  see it as a volume. `losetup` is matched on its own because attaching a file10  to a loop device is itself the act of creating that abstraction, independent11  of what happens to the device afterward; `mount` is only matched when one of12  its next five arguments contains the string `loop`, since a bare `mount`13  call covers every ordinary bind mount, tmpfs and device mount on the system14  and would swamp the rule with unrelated noise. Argument position is not15  fixed — `-o loop`, `-o loop,ro` and `--options=loop` can each land in a16  different argv slot depending on what else is on the command line — so the17  five-argument OR mirrors the a1-a4 pattern already used for T1499.001 rather18  than pinning one position. This rule cannot tell a hidden VFS from an19  entirely ordinary use of the same two commands: nothing in an EXECVE record20  carries where the resulting mount point sits, whether it was subsequently21  unmounted and its backing file deleted, or whether the file itself lives in22  a location a user would call hidden, so the loudest false positives below23  are not edge cases, they are the majority of what this rule returns on a24  typical Linux estate. The Windows analytic (AN1271) and macOS analytic25  (AN1273) in this technique's brief are not used here: AN1271 asks for26  "suspicious disk I/O patterns" and "bootkit-like behavior", neither of which27  names a field on Sysmon EventID 13/14 or Security 4663/4670/4656, and its28  own MonitoredRegistryKeys knob has no MITRE-supplied values to populate it29  with; AN1273's {product: macos, service: unifiedlog} source has no30  established field vocabulary anywhere in this corpus. Prerequisite: raw31  auditd does not record execve by default, so this returns zero rows until a32  rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and33  zero rows reads as quiet when it actually means blind.34  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0461, not hand-written and not tested by its author. Any lab result is on this rule's own page.35references:36  - https://attack.mitre.org/techniques/T1564/00537  - https://attack.mitre.org/detectionstrategies/DET046138author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)39date: 2026-08-1740tags:41  - attack.defense-evasion42  - attack.t1564.00543logsource:44  product: linux45  service: auditd46detection:47  selection_losetup:48    type: 'EXECVE'49    a0|endswith: 'losetup'50  selection_mount:51    type: 'EXECVE'52    a0:53      - 'mount'54      - '/bin/mount'55      - '/usr/bin/mount'56  selection_loop_evidence:57    - a1|contains: 'loop'58    - a2|contains: 'loop'59    - a3|contains: 'loop'60    - a4|contains: 'loop'61    - a5|contains: 'loop'62  condition: selection_losetup or (selection_mount and selection_loop_evidence)63falsepositives:64  - "snapd on Ubuntu and other snap-enabled distributions loop-mounts a squashfs image for every installed or refreshed snap package, which is the highest-volume source of matches on any desktop or server running snapd by a wide margin."65  - "Forensic and VM-image tooling such as guestmount, libguestfs and qcow2/vdi conversion scripts that loop-mount a disk image to inspect, repair or convert it as part of routine backup verification or incident response."66  - "Administrators and build engineers loop-mounting an ISO to browse install media or verify a freshly built image, and image-pipeline tooling such as live-build, debootstrap or cloud-init that loop-mounts a rootfs during provisioning."67level: low