Linux Audit: mknod Syscall Used to Create Special Files

Flags mknod syscall activity in Linux auditd, indicating special file/device node creation.

FreeUnreviewedSigmalowv1

linux-audit-mknod-syscall-used-to-create-special-files-710bdbce

title: "Linux Audit: mknod Syscall Used to Create Special Files"
id: ea4687f4-ad5e-4180-9428-1c12381631e7
status: experimental
description: This rule identifies Linux audit events where the mknod syscall is invoked to create special filesystem entries (such as character or block devices). Creating these device nodes can help attackers interact with kernel-adjacent interfaces, persist across environments, or establish covert communication paths. It relies on Linux auditd telemetry recording syscall events with type SYSCALL and SYSCALL equal to mknod.
references:
  - https://man7.org/linux/man-pages/man2/mknod.2.html
  - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/auditd/syscall/lnx_auditd_susp_special_file_creation_via_mknod_syscall.yml
author: Milad Cheraghi, Huntrule Team
date: 2025-05-31
modified: 2025-12-05
tags:
  - attack.privilege-escalation
  - attack.persistence
  - attack.t1543.003
logsource:
  product: linux
  service: auditd
detection:
  selection:
    type: SYSCALL
    SYSCALL: mknod
  condition: selection
falsepositives:
  - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
  - Container runtimes or security tools during initialization
level: low
license: DRL-1.1
related:
  - id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e
    type: derived

What it detects

This rule identifies Linux audit events where the mknod syscall is invoked to create special filesystem entries (such as character or block devices). Creating these device nodes can help attackers interact with kernel-adjacent interfaces, persist across environments, or establish covert communication paths. It relies on Linux auditd telemetry recording syscall events with type SYSCALL and SYSCALL equal to mknod.

Known false positives

Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
Container runtimes or security tools during initialization

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.