Possible Special File Creation through Mknod Syscall (via auditd)

title: Possible Special File Creation through Mknod Syscall (via auditd)
id: 431e9b81-c806-5063-bbe4-7e4452b40592
status: stable
description: This rule detects use of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be misused to bypass file system restrictions or create backdoors.
references:
    - https://attack.mitre.org/techniques/T1543/003/
    - https://man7.org/linux/man-pages/man2/mknod.2.html
    - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
author: Huntrule Team
date: 2026-07-20
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1543.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'mknod'
    condition: selection
falsepositives:
    - Unknown
level: low