Special File Creation via Mknod Syscall

Milad Cheraghi

Detects usage of the `mknod` syscall to create special files (e.g., character or block devices). Attackers or malware might use `mknod` to create fake devices, interact with kernel interfaces, or establish covert channels in Linux systems. Monitoring the use of `mknod` is important because this syscall is rarely used by legitimate applications, and it can be abused to bypass file system restrictions or create backdoors.

2025-05-31 00:00:00

None

710bdbce-495d-491d-9a8f-7d0d88d2b41e

attack.persistence attack.t1543.003

Community Rule

Milad Cheraghi

Merge PR #5446 from @CheraghiMilad - Special File Creation via Mknod Syscall

2025-06-05