Mknod Process Activity

The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command shell when the traditional version of netcat is not available to the payload.

Rule type: query
Rule indices:

• auditbeat-*
• logs-endpoint.events.*

Rule Severity: low
Risk Score: 21
Runs every:
Searches indices from: now-9m
Maximum alerts per execution: 100
References:

• https://web.archive.org/web/20191218024607/https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem/

Tags:

• Elastic
• Host
• Linux
• Threat Detection

Version: 100
Rule authors:

• Elastic

Rule license: Elastic License v2

event.category:process and event.type:(start or process_started) and process.name:mknod