---
title: Mknod Process Activity
description: The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits. It is used to export a command...
url: https://www.elastic.co/elastic/docs-builder/docs/3167/reference/security/prebuilt-rules/rules/_deprecated/linux_mknod_activity
products:
  - Elastic Security
---

# Mknod Process Activity
<warning>
  This rule has been deprecated as of 2021/04/15.
</warning>

The Linux mknod program is sometimes used in the command payload of a remote command injection (RCI) and other exploits.
It is used to export a command shell when the traditional version of netcat is not available to the payload.
**Rule type**: query
**Rule indices**:
- auditbeat-*
- logs-endpoint.events.*

**Rule Severity**: low
**Risk Score**: 21
**Runs every**: 
**Searches indices from**: `now-9m`
**Maximum alerts per execution**: 100
**References**:
- [[https://web.archive.org/web/20191218024607/https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem/](https://web.archive.org/web/20191218024607/https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem/)](https://web.archive.org/web/20191218024607/https://pen-testing.sans.org/blog/2013/05/06/netcat-without-e-no-problem/)

**Tags**:
- Elastic
- Host
- Linux
- Threat Detection

**Version**: 100
**Rule authors**:
- Elastic

**Rule license**: Elastic License v2

## Rule Query

```kuery
event.category:process and event.type:(start or process_started) and process.name:mknod
```