Techniques › T1564.013 › AN1196
AN1196 Analytic 1196
Linux · attack.mitre.org · ATT&CK Enterprise v19.2
<p>Abuse of bind mounts to obscure process directories. Defender perspective: detecting anomalous mount operations where a process’s /proc entry is remapped to another directory, often hiding malicious activity from native utilities (ps, top). Behavior chain includes: (1) execution of
mount with -o bind or -B flags, (2) modification of /proc entries inconsistent with expected process lineage, and (3) subsequent anomalous activity from processes whose metadata no longer matches execution context.</p>- Detects
- T1564.013 Bind Mounts
- Part of
- DET0428 Detection Strategy for Bind Mounts on Linux
Log sources and channels
Exactly as MITRE states them in x_mitre_log_source_references. Where a channel is vague, it is vague in the source; kevmap does not tidy it.
| Log source | Channel | Data component |
|---|---|---|
| auditd:SYSCALL | mount system call with bind or remap flags | DC0021 OS API Execution |
| auditd:PATH | mount target path within /proc/* | DC0039 File Creation |
| linux:osquery | process metadata mismatch between /proc and runtime attributes | DC0034 Process Metadata |
Mutable elements
Parameters MITRE marks as environment-specific. These are the knobs you are expected to tune; they are why an analytic is not a rule.
| Field | Description |
|---|---|
BindMountFlags | Flags or options used in mount commands (e.g., -o bind, -B). Can vary across distributions and kernels. |
WatchedProcPaths | List of /proc paths to monitor. Tunable to reduce noise from benign bind mounts used in containers or chroot environments. |
CorrelationWindow | Timeframe to correlate bind mount creation with anomalous process or file activity. |