Mount Execution With Hidepid Parameter

Title: Mount Execution With Hidepid Parameter
Status: test
Description:Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
References:
  -https://blogs.blackberry.com/
  -https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
  -https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
Author: Joseliyo Sanchez, @Joseliyo_Jstnk
Date: 2023-01-12
modified:None
Tags:

• -'attack.credential-access'
• -'attack.stealth'
• -'attack.t1564'

Logsource:

• product: linux
• category: process_creation

Detection:
  selection:
    Image|endswith: '/mount'
    CommandLine|contains|all:
      -'hidepid=2'
      -' -o '

  condition:selection
Falsepositives:
  -Unknown
Level: medium