Special File Creation via Mknod Syscall

Status: experimental
Severity: low
Log source: product linux, service auditd
Author: Milad Cheraghi
Source: github.com/SigmaHQ/sigma

Detects usage of the mknod syscall to create special files (e.g., character or block devices). Attackers or malware might use mknod to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of mknod is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

Known false positives

Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
Container runtimes or security tools during initialization

MITRE ATT&CK coverage

Tactic	Techniques
Persistence	`T1543.003` Create or Modify System Process: Windows Service
Privilege Escalation	`T1543.003` Create or Modify System Process: Windows Service

Telemetry coverage

Platform	Record / event type
Linux	auditd SYSCALL record: System call event information

Rule body

title: Special File Creation via Mknod Syscall
id: 710bdbce-495d-491d-9a8f-7d0d88d2b41e
status: experimental
description: |
    Detects usage of the `mknod` syscall to create special files (e.g., character or block devices).
    Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces,
    or establish covert channels in Linux systems.
    Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications,
    and it can be abused to bypass file system restrictions or create backdoors.
references:
    - https://man7.org/linux/man-pages/man2/mknod.2.html
    - https://hopeness.medium.com/master-the-linux-mknod-command-a-comprehensive-guide-1c150a546aa8
author: Milad Cheraghi
date: 2025-05-31
modified: 2025-12-05
tags:
    - attack.privilege-escalation
    - attack.persistence
    - attack.t1543.003
logsource:
    product: linux
    service: auditd
detection:
    selection:
        type: 'SYSCALL'
        SYSCALL: 'mknod'
    condition: selection
falsepositives:
    - Device creation by legitimate scripts or init systems (udevadm, MAKEDEV)
    - Container runtimes or security tools during initialization
level: low

Stages and Predicates

Stage 0: `condition`

selection

Stage 1: `selection`

selection:
    type: 'SYSCALL'
    SYSCALL: 'mknod'

Indicators

These rows show field, operator, and value matches.

Field	Kind	Values	Search
`SYSCALL`	eq	`mknod`	`field:"SYSCALL" kind:eq value:"mknod"`
`type`	eq	`SYSCALL`	`field:"type" kind:eq value:"SYSCALL"`