Adversaries may abuse bind mounts on file structures to hide their activity and artifacts from native utilities. A bind mount maps a directory or file from one location on the filesystem to another, similar to a shortcut on Windows. It’s commonly used to provide access to specific files or directories across different environments, such as inside containers or chroot environments, and requires sudo access.
Adversaries may use bind mounts to map either an empty directory or a benign /proc directory to a malicious process’s /proc directory. Using the commands mount –o bind /proc/benign-process /proc/malicious-process (or mount –B), the malicious process's /proc directory is overlayed with the contents of a benign process's /proc directory. When system utilities query process activity, such as ps and top, the kernel follows the bind mount and presents the benign directory’s contents instead of the malicious process's actual /proc directory. As a result, these utilities display information that appears to come from the benign process, effectively hiding the malicious process's metadata, executable, or other artifacts from detection.[1][2]
| ID | Name | Description |
|---|---|---|
| C0035 | KV Botnet Activity |
KV Botnet Activity leveraged a bind mount to bind itself to the |
This type of attack technique cannot be easily mitigated with preventive controls since it is based on the abuse of system features.
| ID | Data Source | Data Component | Detects |
|---|---|---|---|
| DS0017 | Command | Command Execution |
Configure auditd rules to monitor use of the Analytic 1 - Use of Mount with bind arguments targeting /proc/ paths
|
| DS0022 | File | File Creation |
Monitor for the creation of PID directories under |
| DS0009 | Process | OS API Execution |
Configure auditd rules to monitor use of the Analytic 1 - Using eBPF or sys call logging
|