mount executed with a bind flag targeting a /proc path

Siemphony@siemphonylowT1564.013unverified

Matches step (1) of AN1196's three-part behaviour chain -- "execution of mount with -o bind or -B flags" -- on an auditd EXECVE record, tightened with the technique's own specific target: MITRE's worked example is `mount -o bind /proc/benign-process /proc/malicious-process`, where both the source and the destination of the bind are themselves /proc paths, so this rule requires the executed command to carry both a bind flag and a /proc/ path among its arguments, on the same EXECVE record as the mount invocation itself. This mirrors the EXECVE argv-position pattern already published for T1564.005 (losetup/mount for loop-device hiding): mount's binary name is not fixed to one path (`mount`, `/bin/mount`, `/usr/bin/mount` are all matched as `a0`), and because `-o bind`, `--bind`, `-B` and the source/target paths can each land in a different argv slot depending on what else is on the command line, both the bind flag and the /proc/ path are matched anywhere across a1-a6 rather than pinned to one position. Steps (2) and (3) of AN1196 -- a /proc entry whose contents no longer match its own process's actual lineage, and subsequent anomalous activity from the masked process -- are not attempted: both are comparisons against a process's own prior or expected state, which is an aggregation/correlation this corpus's Sigma models has no operator for, and no single auditd record carries "what /proc/<pid> used to show" for a later event to compare against. This selection also has a real gap in the other direction: a bind mount performed by calling mount(2) directly from a statically linked or interpreted program, without ever exec'ing the `mount` binary, produces no EXECVE record at all and is invisible here -- the same class of miss noted against T1611's namespace-entry rule for setns()/unshare() called in-process. The brief's second auditd source, a PATH record for "mount target path within /proc/*", was considered and set aside: on its own it cannot distinguish a bind mount's target from the enormous ordinary traffic of processes simply opening files under /proc (ps, top, every /proc/self/ read), and auditd's PATH record for a mount syscall does not carry the syscall's flags, so it cannot narrow to "bind" without the EXECVE leg already used here. The third source, linux:osquery process-vs- /proc metadata mismatch, has no established Sigma field vocabulary anywhere in this corpus, the same blocker recorded against linux/osquery in the T1036.004 decline. Prerequisite: raw auditd does not record execve by default, so this returns zero rows until a rule such as `-a always,exit -F arch=b64 -S execve -k exec` is loaded, and zero rows reads as quiet when it actually means blind. UNVERIFIED AS AUTHORED — derived from MITRE ATT&CK DET0428, not hand-written and not tested by its author. Any lab result is on this rule's own page.Full description

The 2 SIEM queries below are previews produced by Siemphony’s own translator, not pySigma, and none has been executed against a real backend — review before you deploy.

detection.yml

Splunk · SPL

Run this as a search.

index=* (((type="EXECVE" AND (a0="mount" OR a0="/bin/mount" OR a0="/usr/bin/mount")) AND ((a1="*bind*" OR a1="*-B*") OR (a2="*bind*" OR a2="*-B*") OR (a3="*bind*" OR a3="*-B*") OR (a4="*bind*" OR a4="*-B*") OR (a5="*bind*" OR a5="*-B*") OR (a6="*bind*" OR a6="*-B*"))) AND (a1="*/proc/*" OR a2="*/proc/*" OR a3="*/proc/*" OR a4="*/proc/*" OR a5="*/proc/*" OR a6="*/proc/*"))

Elastic · ES|QL

Run this as a search.

FROM logs-*| WHERE (((TO_LOWER(type) == "execve" AND (TO_LOWER(a0) == "mount" OR TO_LOWER(a0) == "/bin/mount" OR TO_LOWER(a0) == "/usr/bin/mount")) AND ((TO_LOWER(a1) LIKE "*bind*" OR TO_LOWER(a1) LIKE "*-b*") OR (TO_LOWER(a2) LIKE "*bind*" OR TO_LOWER(a2) LIKE "*-b*") OR (TO_LOWER(a3) LIKE "*bind*" OR TO_LOWER(a3) LIKE "*-b*") OR (TO_LOWER(a4) LIKE "*bind*" OR TO_LOWER(a4) LIKE "*-b*") OR (TO_LOWER(a5) LIKE "*bind*" OR TO_LOWER(a5) LIKE "*-b*") OR (TO_LOWER(a6) LIKE "*bind*" OR TO_LOWER(a6) LIKE "*-b*"))) AND (TO_LOWER(a1) LIKE "*/proc/*" OR TO_LOWER(a2) LIKE "*/proc/*" OR TO_LOWER(a3) LIKE "*/proc/*" OR TO_LOWER(a4) LIKE "*/proc/*" OR TO_LOWER(a5) LIKE "*/proc/*" OR TO_LOWER(a6) LIKE "*/proc/*"))

Sentinel · KQL

Run this as a search.

Sentinel cannot express this construct. No Sentinel table is modelled for this logsource ({"product":"linux","service":"auditd"}), so there is nothing honest to query. Pick a logsource this translator maps, or write the KQL by hand. The Sigma source is on the first tab, unchanged.

Wazuh · XML rule

Deploy to your manager — this is a rule, not a search.

Wazuh cannot express this construct. Expressing this rule in Wazuh needs more than 12 <rule> blocks, because OR across different fields has to be expanded into separate rules. Split the Sigma rule instead. The Sigma source is on the first tab, unchanged.

At a glance

Logsource: auditd / linux
Level: low
Category: hide_artifacts
Sigma status: experimental
Backends: 2 of 4 rendered
Updated: 30 Aug 2026
Rule ID: 681175ca-7c26-4d7f-8606-bb352266fee7

ATT&CKT1564.013

T1564.013Bind Mounts

ATT&CK® is a registered trademark of The MITRE Corporation. These mappings are the rule author’s, and are neither reviewed nor endorsed by MITRE.

Lessonhide artifacts

hide artifactsAI draft — unreviewed

01 · What this rule detects

This rule matches step (1) of AN1196's three-part behaviour chain: execution of mount with a bind flag targeting a /proc path. It's tightened to MITRE's own worked example — mount -o bind /proc/benign-process /proc/malicious-process — where a malicious process's /proc directory is overlaid with a benign one's contents so ps/top display fabricated metadata for it.

02 · Telemetry you need

An auditd EXECVE record for the mount invocation. Raw auditd does not log execve by default; this needs a rule such as -a always,exit -F arch=b64 -S execve -k exec loaded first, or the rule returns zero rows that read as quiet but actually mean blind.

03 · How the logic works

Three ANDed selections, all on type: EXECVE. selection_mount_exec matches a0 against mount, /bin/mount, /usr/bin/mount — the binary isn't pinned to one path. selection_bind_flag ORs a1 through a6|contains for bind or -B, and selection_proc_target separately ORs a1 through a6|contains: '/proc/' — both scanned across every argv slot rather than a fixed position, because -o bind, --bind, -B and the source/target paths can land anywhere depending on what else is on the command line. This mirrors the argv-position pattern already published for T1564.005. Steps (2) and (3) of AN1196 — a /proc entry mismatching its own process's lineage, and subsequent anomalous activity from the masked process — aren't attempted: both require comparing a record against a process's own prior state, which is aggregation/correlation this corpus's Sigma models can't express. The brief's second source, a PATH record for "mount target within /proc/*," was set aside: alone it can't distinguish a bind target from ordinary /proc reads (ps, top, /proc/self), and PATH records carry no syscall flags to narrow to "bind" without this EXECVE leg already in place. The third source, osquery process-vs-/proc metadata mismatch, has no established Sigma field vocabulary anywhere in this corpus.

04 · Common false positives

Three named sources. Container runtimes and orchestrators (runc, containerd, Kubernetes kubelet, LXC) bind-mounting host /proc entries into a container's mount namespace during routine startup — likely the loudest source on a busy container host. Chroot and jail-style sandboxing (BIND9, vsftpd, manually built jails) bind-mounting /proc into a jail root with mount --bind /proc <jail>/proc so contained tools like ps keep functioning — a legitimate, documented admin pattern. Diagnostic and forensic tooling that bind-mounts a specific process's /proc/<pid> elsewhere to inspect it out-of-band without disturbing the running process.

05 · Detection maturity

tier_1: Lowest tier. This rule is UNVERIFIED and has never been executed against real auditd traffic. level: low reflects that the top disclosed false positive — container/orchestrator bind mounts — is a high-volume, entirely legitimate pattern. Promotion requires running against real EXECVE traffic, fixing the -B substring weakness, and confirming the argv-position assumption holds across the mount invocations actually seen.

Tuning & false positivesexperimental · 3 declared

experimental (current stage)
test
stable

Written and reasoned about, but not yet run against real telemetry. Expect to tune it before trusting it.

Tuning tips

Review flagged that -B under contains is a bare two-character substring match: any argv token with a hyphen followed by "b" (a path fragment like webapp-backup, or an unrelated flag like --no-block) satisfies it, not just a standalone bind flag. Tighten by matching -B as an exact, whitespace-delimited argv value instead of a substring. Populate MITRE's WatchedProcPaths knob with your known container/chroot proc-mount targets to exclude them, and set CorrelationWindow if you build the missing step-2/3 correlation externally — treat parent-process context (container runtime vs. interactive shell) as an allowlist rather than baking it into this selection.

Declared by the author

Container runtimes and orchestration tooling (runc, containerd, Kubernetes kubelet, LXC) that bind-mount host /proc entries or a masked /proc/<pid> into a container's mount namespace as a routine part of container start-up and cgroup/PID isolation -- on a busy container host this is the loudest and most frequent source of matches.
chroot and jail-style service sandboxing (BIND9, vsftpd and similar daemons run in a chroot, or manually built jails) that bind-mounts /proc into the jail root with mount --bind /proc <jail>/proc so jailed tools like ps continue to function -- a documented, legitimate systems-administration pattern rather than an evasion attempt.
Diagnostic and forensic tooling (process-namespace inspectors, nsenter-adjacent debugging scripts, some APM/observability agents) that bind-mounts a specific process's /proc/<pid> directory elsewhere to inspect it out-of-band without disturbing the running process.

Noise check0 of 5 fired

Fires on none of the 5 ordinary behaviours the baseline holds for this log type. That is not a precision guarantee: it means only not caught by these 5 behaviours, and the next ordinary behaviour nobody wrote down may still match.

Run live against 65 hand-written events of ordinary corporate activity — backup agents, software distribution, patching, helpdesk scripts, EDR. It says nothing about how often the rule would fire in production, which is the number that actually exhausts an analyst.

Verification1 run

Not verified

Siemphony benign baseline
completed
Siemphony IR · 3 Sept 2026
No events matched, so this run proves nothing either way.

Test it yourselfin your browser

Runs here in your browser against public attack recordings. A preview — not the verification badge.

Recordings of T1564.013, evaluated against their — events.

Share this rule

/u/siemphony/681175ca-7c26-4d7f-8606-bb352266fee7

More from this repertoire

All compositions

Verdicts · reactions · comments

Community

Verdicts from engineers who actually deployed it, and the conversation around it.

Not yet reported on

Nobody has run this in a real environment and said what happened.

Verdicts from engineers who deployed it

0 cast

No verdicts reported yet. The first one is worth more than the tenth — say what you ran it against.

No comments yet. Someone who deploys this will have something to say about it.

mount executed with a bind flag targeting a /proc path

The detection

detection.yml

Splunk · SPL

Elastic · ES|QL

Sentinel · KQL

Wazuh · XML rule

Community

Verdicts from engineers who deployed it