Linux Process Creation: mount Executed with hidepid=2 Option

title: "Linux Process Creation: mount Executed with hidepid=2 Option"
id: 4ed87e41-6d36-4664-b6ca-83183bc3e519
status: test
description: This rule identifies Linux process creation events where the mount binary is executed with the hidepid=2 option set via the command line. Attackers can use hidepid to reduce process visibility across users, which may help conceal activity or persistence within a multi-user system. The detection relies on process execution telemetry including the executable path ending in /mount and the presence of hidepid=2 along with a mount option delimiter in the command line.
references:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-12
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1564
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /mount
    CommandLine|contains|all:
      - hidepid=2
      - " -o "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ec52985a-d024-41e3-8ff6-14169039a0b3
    type: derived