Linux mount executed with hidepid=2 option

Flags Linux mounts that include hidepid=2, a stealth configuration that hides processes from other users.

FreeReviewedSigma · Medium · v2

Product: linux
Category: process_creation
Author: Joseliyo Sanchez, @Joseliyo_Jstnk (SigmaHQ), DRL 1.1
Published: 2023-01-12
Updated: 2026-07-31

ATT&CK techniques

Defense Evasion

Recon
Resource Dev
Initial Access
Execution
Persistence
Priv Esc
Defense Evasion
- T1564Hide Artifacts
Cred Access
Discovery
Lateral Movement
Collection
C2
Exfiltration
Impact

What it detects

This rule identifies process creation where the command executed is mount and the command line includes the hidepid=2 option with an output mount argument (" -o "). Attackers can use hidepid to reduce visibility of processes to other users, supporting stealth and defense evasion. Detection relies on Linux process creation telemetry including the executable path and full command line.

Reporting behind it

Related detections9 linkedT1564 — drag to rearrange

Suspicious Windows Security Spoofing via pin Executable Writing output.txt via process_creation

Obfuscated Extended Rights Backdoor Obfuscation - Via localizationDisplayId Attribute (via security)

Suspicious Process Execution from Public User Media Folders via process_creation

Suspicious Windows Sandbox Configuration Execution for AsyncRAT via Process Creation

System Informer Execution on Windows Process Creation

Windows Process Hacker Execution Identified by Image Metadata and Hashes

Windows File Events: Suspicious Executable File Name Creation

Windows: Suspicious Parent Process Execution From \Users\Public Spawning Scripting/Shell Binaries

Windows Registry: Disable CrashDump via CrashControl DWORD value

Linux mount executed with hidepid=2 option

Pivot detection · T1564 · 9 related

Changelog

v2
Candidate ingested via manual entry.2026-07-31
v1
No changelog recorded for this version.2026-07-30

Detection content is published as a reviewed draft. Tune thresholds and exclusions against your own telemetry before enabling this rule for alerting.

linux-process-creation-mount-executed-with-hidepid-2-option-ec52985a

title: Linux mount executed with hidepid=2 option
id: 4ed87e41-6d36-4664-b6ca-83183bc3e519
status: test
description: This rule identifies process creation where the command executed is mount and the command line includes the hidepid=2 option with an output mount argument (" -o "). Attackers can use hidepid to reduce visibility of processes to other users, supporting stealth and defense evasion. Detection relies on Linux process creation telemetry including the executable path and full command line.
references:
  - https://blogs.blackberry.com/
  - https://www.cyberciti.biz/faq/linux-hide-processes-from-other-users/
  - https://twitter.com/Joseliyo_Jstnk/status/1620131033474822144
  - https://github.com/SigmaHQ/sigma/blob/master/rules/linux/process_creation/proc_creation_lnx_mount_hidepid.yml
author: Joseliyo Sanchez, @Joseliyo_Jstnk, Huntrule Team
date: 2023-01-12
tags:
  - attack.credential-access
  - attack.stealth
  - attack.t1564
logsource:
  product: linux
  category: process_creation
detection:
  selection:
    Image|endswith: /mount
    CommandLine|contains|all:
      - hidepid=2
      - " -o "
  condition: selection
falsepositives:
  - Unknown
level: medium
license: DRL-1.1
related:
  - id: ec52985a-d024-41e3-8ff6-14169039a0b3
    type: derived

Convert

This rule as a query you can run. Uses no unlock credit.

SplunkSPL