{"id":"ec52985a-d024-41e3-8ff6-14169039a0b3","title":"Mount Execution With Hidepid Parameter","description":"Detects execution of the \"mount\" command with \"hidepid\" parameter to make invisible processes to other users from the system","author":"Joseliyo Sanchez, @Joseliyo_Jstnk","status":"test","level":"medium","date":"2023-01-12","modified":"","tags":["attack.credential-access","attack.stealth","attack.t1564"],"technique_ids":["T1564"],"logsource":{"product":"linux","category":"process_creation"},"falsepositives":["Unknown"],"references":["https://blogs.blackberry.com/","https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/","https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144"],"source_path":"rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml","source_sha256":"ba2795e4076f83db9900ce620c5ce979fec61384003d4ff055337c8e68ac0edc","source_url":"https://github.com/anpa1200/sigma/blob/b249e9683190cffdcaf188ccbfb90bf4759844e1/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml","license":"Detection Rule License 1.1","license_url":"https://github.com/SigmaHQ/Detection-Rule-License/blob/main/LICENSE.Detection.Rules.md","yaml":"title: Mount Execution With Hidepid Parameter\nid: ec52985a-d024-41e3-8ff6-14169039a0b3\nstatus: test\ndescription: Detects execution of the \"mount\" command with \"hidepid\" parameter to make invisible processes to other users from the system\nreferences:\n    - https://blogs.blackberry.com/\n    - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/\n    - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144\nauthor: Joseliyo Sanchez, @Joseliyo_Jstnk\ndate: 2023-01-12\ntags:\n    - attack.credential-access\n    - attack.stealth\n    - attack.t1564\nlogsource:\n    product: linux\n    category: process_creation\ndetection:\n    selection:\n        Image|endswith: '/mount'\n        CommandLine|contains|all:\n            - 'hidepid=2'\n            - ' -o '\n    condition: selection\nfalsepositives:\n    - Unknown\nlevel: medium\n","validation":"yaml_parsed_not_backend_compiled_or_live_validated","techniques":[{"key":"enterprise/T1564","id":"T1564","name":"Hide Artifacts","page":"techniques/enterprise/T1564/"}],"data_path":"data/detection-rules/ec52985a-d024-41e3-8ff6-14169039a0b3.json","kind":"sigma"}