1200KM / sigma-rule
Special File Creation via Mknod Syscall — Sigma Rule
Sigma rule 710bdbce-495d-491d-9a8f-7d0d88d2b41e. Special File Creation via Mknod Syscall — Sigma Rule. Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.
Rule metadata and linked tags
Author: Milad Cheraghi. Source status: experimental; severity: low. Source dates: 2025-05-31 / 2025-12-05.
{
"product": "linux",
"service": "auditd"
}Pinned original Sigma rule · Detection Rule License 1.1
Source SHA-256: ed033360d0682c68bb8264a21570ec86d51dff40bf7ebb654615371e48ab7399
Detection logic
Original source YAML. Source-tag agreement is not proof of complete semantic coverage. This rule has not been compiled for a SIEM backend or validated against live telemetry here.
title: Special File Creation via Mknod Syscall
id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e
status: experimental
description: |
Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
references:
- https://man7.org/linux/man-pages/man2/mknod.2.html
- https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
author: Milad Cheraghi
date: 2025-05-31
modified: 2025-12-05
tags:
- attack.privilege-escalation
- attack.persistence
- attack.t1543.003
logsource:
product: linux
service: auditd
detection:
selection:
type: 'SYSCALL'
SYSCALL: 'mknod'
condition: selection
falsepositives:
- Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
- Container runtimes or security tools during initialization
level: low
False positives
- Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
- Container runtimes or security tools during initialization
Source references
Connected ecosystem references
Exact source-tagged techniques
Telemetry review
Read the original logsource above, then inspect the linked detection workspaces for technique-level sensor context. No per-rule telemetry equivalence is inferred.
Pinned research references. No browser attack runner, live simulation result or validated detector is asserted. Source mappings and validation limits are preserved. ATT&CK / Atomic provenance · Detection provenance.