mount executed with a bind flag targeting a /proc path

1title: mount executed with a bind flag targeting a /proc path2id: 681175ca-7c26-4d7f-8606-bb352266fee73status: experimental4description: |5  Matches step (1) of AN1196's three-part behaviour chain -- "execution of6  mount with -o bind or -B flags" -- on an auditd EXECVE record, tightened7  with the technique's own specific target: MITRE's worked example is8  `mount -o bind /proc/benign-process /proc/malicious-process`, where both9  the source and the destination of the bind are themselves /proc paths, so10  this rule requires the executed command to carry both a bind flag and a11  /proc/ path among its arguments, on the same EXECVE record as the mount12  invocation itself. This mirrors the EXECVE argv-position pattern already13  published for T1564.005 (losetup/mount for loop-device hiding): mount's14  binary name is not fixed to one path (`mount`, `/bin/mount`,15  `/usr/bin/mount` are all matched as `a0`), and because `-o bind`,16  `--bind`, `-B` and the source/target paths can each land in a different17  argv slot depending on what else is on the command line, both the bind18  flag and the /proc/ path are matched anywhere across a1-a6 rather than19  pinned to one position. Steps (2) and (3) of AN1196 -- a /proc entry whose20  contents no longer match its own process's actual lineage, and subsequent21  anomalous activity from the masked process -- are not attempted: both are22  comparisons against a process's own prior or expected state, which is an23  aggregation/correlation this corpus's Sigma models has no operator for,24  and no single auditd record carries "what /proc/<pid> used to show" for a25  later event to compare against.26  This selection also has a real gap in the other direction: a bind mount27  performed by calling mount(2) directly from a statically linked or28  interpreted program, without ever exec'ing the `mount` binary, produces no29  EXECVE record at all and is invisible here -- the same class of miss noted30  against T1611's namespace-entry rule for setns()/unshare() called31  in-process. The brief's second auditd source, a PATH record for "mount32  target path within /proc/*", was considered and set aside: on its own it33  cannot distinguish a bind mount's target from the enormous ordinary34  traffic of processes simply opening files under /proc (ps, top, every35  /proc/self/ read), and auditd's PATH record for a mount syscall does not36  carry the syscall's flags, so it cannot narrow to "bind" without the37  EXECVE leg already used here. The third source, linux:osquery process-vs-38  /proc metadata mismatch, has no established Sigma field vocabulary39  anywhere in this corpus, the same blocker recorded against linux/osquery40  in the T1036.004 decline.41  Prerequisite: raw auditd does not record execve by default, so this42  returns zero rows until a rule such as43  `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows44  reads as quiet when it actually means blind.45  UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0428, not hand-written and not tested by its author. Any lab result is on this rule's own page.46references:47  - https://attack.mitre.org/techniques/T1564/01348  - https://attack.mitre.org/detectionstrategies/DET042849author: Siemphony pipeline (machine-derived from MITRE ATT&CK v19.2)50date: 2026-08-1851tags:52  - attack.defense-evasion53  - attack.t1564.01354logsource:55  product: linux56  service: auditd57detection:58  selection_mount_exec:59    type: 'EXECVE'60    a0:61      - 'mount'62      - '/bin/mount'63      - '/usr/bin/mount'64  selection_bind_flag:65    - a1|contains: ['bind', '-B']66    - a2|contains: ['bind', '-B']67    - a3|contains: ['bind', '-B']68    - a4|contains: ['bind', '-B']69    - a5|contains: ['bind', '-B']70    - a6|contains: ['bind', '-B']71  selection_proc_target:72    - a1|contains: '/proc/'73    - a2|contains: '/proc/'74    - a3|contains: '/proc/'75    - a4|contains: '/proc/'76    - a5|contains: '/proc/'77    - a6|contains: '/proc/'78  condition: selection_mount_exec and selection_bind_flag and selection_proc_target79falsepositives:80  - "Container runtimes and orchestration tooling (runc, containerd, Kubernetes kubelet, LXC) that bind-mount host /proc entries or a masked /proc/<pid> into a container's mount namespace as a routine part of container start-up and cgroup/PID isolation -- on a busy container host this is the loudest and most frequent source of matches."81  - "chroot and jail-style service sandboxing (BIND9, vsftpd and similar daemons run in a chroot, or manually built jails) that bind-mounts /proc into the jail root with `mount --bind /proc <jail>/proc` so jailed tools like `ps` continue to function -- a documented, legitimate systems-administration pattern rather than an evasion attempt."82  - "Diagnostic and forensic tooling (process-namespace inspectors, `nsenter`-adjacent debugging scripts, some APM/observability agents) that bind-mounts a specific process's /proc/<pid> directory elsewhere to inspect it out-of-band without disturbing the running process."83level: low