Defense Evasion via Bind Mount

[rule]
description = """
Identifies the use of the "mount" command to bind mount a directory to "/proc" in order to hide files or processes from
detection. This technique is used in the wild by malware samples to evade detection by hiding files or processes from
security tools that rely on "/proc" to gather information about running processes.
"""
id = "69b41dec-033a-4629-9b1d-dd2c54b507b9"
license = "Elastic License v2"
name = "Defense Evasion via Bind Mount"
os_list = ["linux"]
reference = ["https://dfir.ch/posts/slash-proc/"]
version = "1.0.5"

query = '''
process where event.type == "start" and event.action == "exec" and process.name == "mount" and
process.args in ("-B", "--bind", "-R", "--rbind", "-M", "--move") and
process.args like "/proc/*" and process.args_count >= 5 and not process.args like "/proc/*/*"
'''

min_endpoint_version = "7.15.0"
optional_actions = []
[[actions]]
action = "kill_process"
field = "process.entity_id"
state = 0

[[actions]]
action = "kill_process"
field = "process.parent.entity_id"
state = 0

[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1059"
name = "Command and Scripting Interpreter"
reference = "https://attack.mitre.org/techniques/T1059/"
[[threat.technique.subtechnique]]
id = "T1059.004"
name = "Unix Shell"
reference = "https://attack.mitre.org/techniques/T1059/004/"



[threat.tactic]
id = "TA0002"
name = "Execution"
reference = "https://attack.mitre.org/tactics/TA0002/"
[[threat]]
framework = "MITRE ATT&CK"
[[threat.technique]]
id = "T1564"
name = "Hide Artifacts"
reference = "https://attack.mitre.org/techniques/T1564/"


[threat.tactic]
id = "TA0005"
name = "Defense Evasion"
reference = "https://attack.mitre.org/tactics/TA0005/"

[internal]
min_endpoint_version = "7.15.0"