Title:
Special File Creation via Mknod Syscall
Status:
experimental
Description:Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
or establish covert channels in Linux systems.
Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
and it can be abused to bypass file system restrictions or create backdoors.
References:
-https://man7.org/linux/man-pages/man2/mknod.2.html
-https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
Author: Milad Cheraghi
Date: 2025-05-31
modified:2025-12-05
Tags:
- -'attack.privilege-escalation'
- -'attack.persistence'
- -'attack.t1543.003'
Logsource:
- product: linux
- service: auditd
Detection:
selection:
type:
'SYSCALL'
SYSCALL:
'mknod'
condition:
selection
Falsepositives:
-Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
-Container runtimes or security tools during initialization
Level:
low
