Detect Bind Mounts in Sumo Logic CSE
Adversaries may abuse bind mounts on Linux file structures to hide malicious process activity from native utilities such as ps, top, and /proc filesystem inspection. A bind mount maps a directory or file from one location to another using mount --bind, mount -B, or mount -o bind. By overlaying a benign process's /proc entry on top of a malicious process's /proc directory (e.g., mount --bind /proc/<benign_pid> /proc/<malicious_pid>), adversaries cause the kernel to present false process metadata to monitoring utilities. This technique requires root or sudo privileges and has been observed in active campaigns including Commando Cat (Docker container abuse) and cryptomining attacks documented by AhnLab.
MITRE ATT&CK
- Tactic
- Defense Evasion
- Technique
- T1564 Hide Artifacts
- Sub-technique
- T1564.013 Bind Mounts
- Canonical reference
- https://attack.mitre.org/techniques/T1564/013/
Sumo Detection Query
_sourceCategory=linux/sysmon OR _sourceCategory=linux/audit
| json auto
| where EventID == "1"
| eval ImageLower = toLower(coalesce(Image,""))
| eval CmdLower = toLower(coalesce(CommandLine,""))
| where ImageLower matches ".*/mount$"
| eval is_bind = if(CmdLower matches ".*(--bind|-o bind|-obind|-B ).*", 1, 0)
| eval targets_proc = if(CmdLower matches ".*/proc.*", 1, 0)
| eval targets_sys = if(CmdLower matches ".*/sys.*", 1, 0)
| where is_bind == 1 AND (targets_proc == 1 OR targets_sys == 1)
| eval risk = if(targets_proc == 1, "critical", "high")
| table _time, Computer, User, Image, CommandLine, ParentImage, risk
| sort by _time descDetects Linux bind mount operations hiding /proc content in Sumo Logic.
Data Sources
Required Tables
False Positives & Tuning
- Container runtimes (Docker, containerd, podman) legitimately use bind mounts for volume mapping, though these typically target /var, /tmp, or application directories rather than /proc
- System administrators or SREs using bind mounts during chroot or namespace operations for legitimate troubleshooting or environment setup
- Configuration management tools (Ansible, Chef) mounting /proc inside test containers or build environments during CI/CD pipelines
- Linux Live CD / forensic boot environments that bind-mount host /proc into investigation chroot environments
Other platforms for T1564.013
Testing Methodology
Validate this detection against 4 adversary techniques from Atomic Red Team. Each test below lists the behaviour to exercise and the telemetry you should expect to see. Executable commands and cleanup steps are available with Pro.
- Test 1Bind Mount Empty Directory Over Process /proc Entry
Expected signal: auditd EXECVE: type=EXECVE msg=audit(...): argc=4 a0="mount" a1="--bind" a2="/tmp/empty_proc_decoy" a3="/proc/<pid>". auditd SYSCALL: syscall=mount uid=0 auid=<real_user_uid> exe=/usr/bin/mount comm=mount. Sysmon for Linux (if deployed): EventCode=1, Image=/usr/bin/mount, CommandLine='mount --bind /tmp/empty_proc_decoy /proc/<pid>'. DeviceProcessEvents: FileName=mount, ProcessCommandLine containing '--bind' and '/proc/<numeric_pid>'.
- Test 2Bind Mount Benign Process /proc Entry Over Malicious Process
Expected signal: auditd EXECVE: a0=mount a1=--bind a2=/proc/<benign_pid> a3=/proc/<malicious_pid>. auditd SYSCALL: syscall=mount, uid=0, auid=<escalated_user_uid>. DeviceProcessEvents: ProcessCommandLine='mount --bind /proc/<benign_pid> /proc/<malicious_pid>', both paths matching /proc/\d+ pattern. Kernel audit trail will show two numeric /proc paths as arguments.
- Test 3Bind Mount Using -B Short Flag (Alternative Syntax)
Expected signal: auditd EXECVE: a0=mount a1=-B a2=/tmp/df00tech_decoy a3=/proc/<pid>. Note: -B must be detected separately from --bind. DeviceProcessEvents: ProcessCommandLine containing ' -B ' with /proc/<pid>. Detection queries that only match on '--bind' will miss this variant — verify both patterns fire.
- Test 4Simulate Commando Cat Docker Container Bind Mount Pattern
Expected signal: DeviceProcessEvents: FileName=mount, InitiatingProcessFileName=bash (inside container namespace), ProcessCommandLine='mount --bind /decoy /host_proc/<pid>'. Container runtime logs: docker run event with --privileged and --pid=host flags. auditd on host: SYSCALL mount from container namespace, uid=0, auid may be 4294967295 (unset) if running fully inside container — key differentiator for container-origin attacks. Docker events: `docker events --filter event=start` will show the container invocation.
References (9)
- https://attack.mitre.org/techniques/T1564/013/
- https://www.cadosecurity.com/blog/the-nine-lives-of-commando-cat-analysing-a-novel-malware-campaign-targeting-docker
- https://asec.ahnlab.com/en/51908/
- https://man7.org/linux/man-pages/man8/mount.8.html
- https://man7.org/linux/man-pages/man2/mount.2.html
- https://www.kernel.org/doc/html/latest/filesystems/sharedsubtree.html
- https://github.com/redcanaryco/atomic-red-team/blob/master/atomics/T1564.013/T1564.013.md
- https://learn.microsoft.com/en-us/azure/sentinel/connect-syslog
- https://docs.splunk.com/Documentation/AddOns/released/LinuxAudit/Configureinputs
Unlock Pro Content
Get the full detection package for T1564.013 including response playbook, investigation guide, and atomic red team tests.